ramnit | d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb

General

Target

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
Size

1.2MB
MD5

238d22b76cd6fd7b3a74b363ed9c3383
SHA1

cf0e4d7c081bdfe7adf473219e1632dd1d5a1817
SHA256

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb
SHA512

5a59062f14a1128335f42c04c86114404ca656080c4d19fe4a259c6e79d2a3b221d8288fb5b2737bd8a058f9a285527b1a1d4ccda1efd1852b877b23c115cd96

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe:*:enabled:@shell32.dll,-1"	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exeDesktopLayer.exe

pid process

2136 d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
2460 DesktopLayer.exe

pid	process
2136	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
2460	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/2136-124-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px2DAD.tmp	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe

Drops file in Windows directory 1 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

description ioc process

File opened for modification C:\Windows\ftpcache\ d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

description	ioc	process
File opened for modification	C:\Windows\ftpcache\	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327281831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0B4A487-B5D1-11EB-B2DB-F6C5063C2468} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327281719"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327281662"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exeDesktopLayer.exe

pid	process
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
2460	DesktopLayer.exe
2460	DesktopLayer.exe
2460	DesktopLayer.exe
2460	DesktopLayer.exe
2460	DesktopLayer.exe
2460	DesktopLayer.exe
2460	DesktopLayer.exe
2460	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2608 iexplore.exe

Suspicious behavior: MapViewOfSection 63 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

pid	process
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

description pid process

Token: SeDebugPrivilege 3492 d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

description	pid	process
Token: SeDebugPrivilege	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exeiexplore.exe

pid	process
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
2608	iexplore.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

pid	process
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exed7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exeIEXPLORE.EXE

pid	process
2608	iexplore.exe
2608	iexplore.exe
3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
192	IEXPLORE.EXE
192	IEXPLORE.EXE
192	IEXPLORE.EXE
192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe

description	pid	process	target process
PID 3492 wrote to memory of 2136	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
PID 3492 wrote to memory of 2136	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
PID 3492 wrote to memory of 2136	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
PID 3492 wrote to memory of 548	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	winlogon.exe
PID 3492 wrote to memory of 548	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	winlogon.exe
PID 3492 wrote to memory of 548	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	winlogon.exe
PID 3492 wrote to memory of 548	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	winlogon.exe
PID 3492 wrote to memory of 548	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	winlogon.exe
PID 3492 wrote to memory of 548	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	winlogon.exe
PID 3492 wrote to memory of 624	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	lsass.exe
PID 3492 wrote to memory of 624	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	lsass.exe
PID 3492 wrote to memory of 624	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	lsass.exe
PID 3492 wrote to memory of 624	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	lsass.exe
PID 3492 wrote to memory of 624	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	lsass.exe
PID 3492 wrote to memory of 624	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	lsass.exe
PID 3492 wrote to memory of 708	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 708	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 708	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 708	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 708	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 708	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 720	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 720	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 720	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 720	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 720	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 720	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 728	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 728	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 728	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 728	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 728	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 728	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	fontdrvhost.exe
PID 3492 wrote to memory of 792	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 792	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 792	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 792	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 792	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 792	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 844	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 844	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 844	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 844	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 844	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 844	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 884	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 884	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 884	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 884	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 884	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 884	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 972	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	dwm.exe
PID 3492 wrote to memory of 972	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	dwm.exe
PID 3492 wrote to memory of 972	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	dwm.exe
PID 3492 wrote to memory of 972	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	dwm.exe
PID 3492 wrote to memory of 972	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	dwm.exe
PID 3492 wrote to memory of 972	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	dwm.exe
PID 3492 wrote to memory of 1000	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 1000	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 1000	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 1000	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 1000	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 1000	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe
PID 3492 wrote to memory of 64	3492	d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:624

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:548

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:972

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:728

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:64

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1152

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1252

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1488

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1820

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2128

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2428

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2628

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3216

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3300

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:3380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:2384

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3728

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3452

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3232

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3000

C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe
"C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafb.exe"
2⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2136

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2460

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2608

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:82945 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2620

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:3324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2600

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2540

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2512

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2488

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2336

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc
1⤵
PID:2248

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:2028

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1964

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1736

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1596

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1552

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1524

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1412

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1300

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1232

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:700

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1000

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:884

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:792

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2⤵
PID:900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:1620

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:720

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:4016

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:1100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\d7f7fffb978d1833df9f7a4c4073bbaeee52759f598653cbe8303c7d1f07aafbSrv.exe
MD5
e7efb2a2b36ab241b6c9b770abf95000

SHA1
d4c253cbf80dc65a04747aea4afc91de6a4a4c5d

SHA256
4c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8

SHA512
958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3

Download Submit
memory/192-129-0x0000000000000000-mapping.dmp

Download
memory/2136-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2136-114-0x0000000000000000-mapping.dmp

Download
memory/2136-127-0x000000007FEA0000-0x000000007FEAC000-memory.dmp

Filesize
48KB

Download
memory/2136-123-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/2460-117-0x0000000000000000-mapping.dmp

Download
memory/2460-120-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2608-122-0x00007FF9F4F20000-0x00007FF9F4F8B000-memory.dmp

Filesize
428KB

Download
memory/2608-121-0x0000000000000000-mapping.dmp

Download
memory/3492-128-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads