ramnit | ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915

General

Target

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
Size

1.2MB
MD5

11367c0c2fa926fafd1b72ae2cdb5c6c
SHA1

23a9dc526e54a5b88470aa0b228e6b58b916fe47
SHA256

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915
SHA512

034abd8024b66bd504e6f2771cc5c29c8fc45ff2a19678777bb9e1b267cecdb5652119475bd5a3ea97259406cf59c84347012919121a248dc9aa4aa7fe71a12e

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe:*:enabled:@shell32.dll,-1"	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exeDesktopLayer.exe

pid process

1536 ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
1796 DesktopLayer.exe

pid	process
1536	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
1796	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe	upx
behavioral2/memory/1536-123-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px25CD.tmp	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe

Drops file in Windows directory 1 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

description ioc process

File opened for modification C:\Windows\ftpcache\ ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

description	ioc	process
File opened for modification	C:\Windows\ftpcache\	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886337"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "424484565"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "416827600"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886337"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327920703"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327888711"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886337"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "416827600"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327872118"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{443F7E6D-B5B4-11EB-A11C-CE9B817779E4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exeDesktopLayer.exe

pid	process
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
1796	DesktopLayer.exe
1796	DesktopLayer.exe
1796	DesktopLayer.exe
1796	DesktopLayer.exe
1796	DesktopLayer.exe
1796	DesktopLayer.exe
1796	DesktopLayer.exe
1796	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2812 iexplore.exe

Suspicious behavior: MapViewOfSection 61 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

pid	process
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

description pid process

Token: SeDebugPrivilege 3724 ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

description	pid	process
Token: SeDebugPrivilege	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exeiexplore.exe

pid	process
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
2812	iexplore.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

pid	process
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exece771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exeIEXPLORE.EXE

pid	process
2812	iexplore.exe
2812	iexplore.exe
3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
3944	IEXPLORE.EXE
3944	IEXPLORE.EXE
3944	IEXPLORE.EXE
3944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exece771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe

description	pid	process	target process
PID 3724 wrote to memory of 1536	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
PID 3724 wrote to memory of 1536	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
PID 3724 wrote to memory of 1536	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
PID 3724 wrote to memory of 552	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	winlogon.exe
PID 3724 wrote to memory of 552	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	winlogon.exe
PID 3724 wrote to memory of 552	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	winlogon.exe
PID 3724 wrote to memory of 552	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	winlogon.exe
PID 3724 wrote to memory of 552	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	winlogon.exe
PID 3724 wrote to memory of 552	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	winlogon.exe
PID 3724 wrote to memory of 632	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	lsass.exe
PID 3724 wrote to memory of 632	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	lsass.exe
PID 3724 wrote to memory of 632	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	lsass.exe
PID 3724 wrote to memory of 632	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	lsass.exe
PID 3724 wrote to memory of 632	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	lsass.exe
PID 3724 wrote to memory of 632	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	lsass.exe
PID 3724 wrote to memory of 716	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 716	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 716	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 716	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 716	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 716	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 1536 wrote to memory of 1796	1536	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe	DesktopLayer.exe
PID 1536 wrote to memory of 1796	1536	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe	DesktopLayer.exe
PID 1536 wrote to memory of 1796	1536	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe	DesktopLayer.exe
PID 3724 wrote to memory of 720	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 720	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 720	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 720	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 720	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 720	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	fontdrvhost.exe
PID 3724 wrote to memory of 736	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 736	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 736	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 736	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 736	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 736	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 804	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 804	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 804	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 804	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 804	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 804	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 856	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 856	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 856	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 856	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 856	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 856	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 896	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 896	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 896	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 896	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 896	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 896	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 984	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	dwm.exe
PID 3724 wrote to memory of 984	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	dwm.exe
PID 3724 wrote to memory of 984	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	dwm.exe
PID 3724 wrote to memory of 984	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	dwm.exe
PID 3724 wrote to memory of 984	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	dwm.exe
PID 3724 wrote to memory of 984	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	dwm.exe
PID 3724 wrote to memory of 348	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 348	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 348	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe
PID 3724 wrote to memory of 348	3724	ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:632

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:552

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:720

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:984

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:716

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:736

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:856

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1548

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe
"C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915.exe"
2⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724

C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1536

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1796

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:82945 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3944

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2736

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2692

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2676

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:4004

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2652

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3752

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:3296

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3760

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:4072

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3464

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3276

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2612

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2592

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2468

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2428

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4
1⤵
PID:2280

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1568

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2028

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1932

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1760

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1512

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1504

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1440

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1420

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1316

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1284

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1244

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1132

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1052

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:620

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:804

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2⤵
PID:412

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:1236

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
a0a5a4d72ad62fd610b043c84033deaf

SHA1
aa5c3deaba3b479e004880b369f63f2b59b23b9a

SHA256
35d20d28885d84fef2a2e06125bf9626fbab13b99d1238a435a444a8db1cb9c6

SHA512
20dd0d4276e854bca2767bd4cf7f04068a23742ff33926a7ba5296d2b0a453d456f37662e443c4df2fc3027bbead658a8ca6f8be40a61c82e3d6085cf85b9243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
b5a4750cb327172f28c7ca1aafc854e6

SHA1
fb6976206e506150d385740465dffb34196dd391

SHA256
86da543ddba3127d4fa3d0b78e633c1d13ba9864f85c5d1c3d5c9f87b68bf52b

SHA512
ea30191f6efface51cbd2d72964623e86c102c1dd22d076bc5dc68c29efb30653aac433501795c81de20e207c0aaf9397d44bcab330c572b2d79b9e3786f3877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\B4Y2JWK3.cookie
MD5
093402755f6cf64dd71ab4c6f6214b9b

SHA1
6f2c469e5422777f491dad39c9e78b5310b2f0a3

SHA256
00372c325e0d408f2cc9d7dc405d03e01893f545b474191548d7837ca3d9186f

SHA512
c4fd95a14213687327e101a28c334862a52b453f313e64837b3aabde9a0a9e6bed72c82dd7cf8c2be9bed27f1155c28a879fdb59255fb5fc6dd317af63fefaa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Z900S8S7.cookie
MD5
81d4a56fec0e2d346d4b4a6aea09fc90

SHA1
14ece75c2bb279d0116939374727401b3e465cc4

SHA256
57b62cb9cf3b1e0c91dfe03f2ed66b10e9d0606d1434817ac39f7bfca96f024b

SHA512
7e05eb2f88a5535d960b2f5379fb2b40d9386b9e776fb176f39995ba9b1129104b1059850616ab7a098bbd65db44b0ad5877173156a146303f0eb2a38662c102

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ce771bdce099e63c37155069b119c63c7ae2f9125945e6584e690e1edbaa5915Srv.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
memory/1536-121-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/1536-123-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1536-114-0x0000000000000000-mapping.dmp

Download
memory/1796-120-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1796-117-0x0000000000000000-mapping.dmp

Download
memory/2812-122-0x0000000000000000-mapping.dmp

Download
memory/2812-126-0x00007FFA58150000-0x00007FFA581BB000-memory.dmp

Filesize
428KB

Download
memory/3724-128-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3944-127-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads