ramnit | 1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e

Analysis

max time kernel
127s
max time network
154s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-06-2022 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
Size

1.3MB
MD5

1aab0bc42e16efbbe769dd65414c848d
SHA1

8e3c247de2459f9ed4885999678a8dcc15b54881
SHA256

1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e
SHA512

c10e307dc85467ba2dbd955f6387f44a3a67476afc5e8f8c98e695dca12fc452eed41b76a9f087b5db7b2ab1db4f390048059e1ca0664f78a08a07fcd078c248

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	acprotect

Executes dropped EXE 3 IoCs

Processes:

ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exeDesktopLayer.exe

pid	process
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
1972	DesktopLayer.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	upx
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	upx
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/2032-77-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/1972-88-0x0000000000400000-0x000000000042E000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	upx
behavioral1/memory/1312-90-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Loads dropped DLL 13 IoCs

Processes:

1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exeDesktopLayer.exe

pid	process
1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
1972	DesktopLayer.exe
1972	DesktopLayer.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Drops file in Program Files directory 3 IoCs

Processes:

ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px2E23.tmp	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62046051-EA97-11EC-9B43-52E0D673F3E2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "361834627"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

DesktopLayer.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

pid	process
1972	DesktopLayer.exe
1972	DesktopLayer.exe
1972	DesktopLayer.exe
1972	DesktopLayer.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

708 iexplore.exe

pid	process
708	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exeiexplore.exeIEXPLORE.EXE

pid	process
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
708	iexplore.exe
708	iexplore.exe
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

description	pid	process	target process
PID 1664 wrote to memory of 1312	1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 1664 wrote to memory of 1312	1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 1664 wrote to memory of 1312	1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 1664 wrote to memory of 1312	1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 1664 wrote to memory of 1312	1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 1664 wrote to memory of 1312	1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 1664 wrote to memory of 1312	1664	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 1312 wrote to memory of 2032	1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 1312 wrote to memory of 2032	1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 1312 wrote to memory of 2032	1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 1312 wrote to memory of 2032	1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 1312 wrote to memory of 2032	1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 1312 wrote to memory of 2032	1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 1312 wrote to memory of 2032	1312	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 2032 wrote to memory of 1972	2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 2032 wrote to memory of 1972	2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 2032 wrote to memory of 1972	2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 2032 wrote to memory of 1972	2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 2032 wrote to memory of 1972	2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 2032 wrote to memory of 1972	2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 2032 wrote to memory of 1972	2032	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 1972 wrote to memory of 708	1972	DesktopLayer.exe	iexplore.exe
PID 1972 wrote to memory of 708	1972	DesktopLayer.exe	iexplore.exe
PID 1972 wrote to memory of 708	1972	DesktopLayer.exe	iexplore.exe
PID 1972 wrote to memory of 708	1972	DesktopLayer.exe	iexplore.exe
PID 708 wrote to memory of 1584	708	iexplore.exe	IEXPLORE.EXE
PID 708 wrote to memory of 1584	708	iexplore.exe	IEXPLORE.EXE
PID 708 wrote to memory of 1584	708	iexplore.exe	IEXPLORE.EXE
PID 708 wrote to memory of 1584	708	iexplore.exe	IEXPLORE.EXE
PID 708 wrote to memory of 1584	708	iexplore.exe	IEXPLORE.EXE
PID 708 wrote to memory of 1584	708	iexplore.exe	IEXPLORE.EXE
PID 708 wrote to memory of 1584	708	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
"C:\Users\Admin\AppData\Local\Temp\1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664

C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
"C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2032

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:708 CREDAT:275457 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JGZ69EDR.txt

Filesize
600B

MD5
fb4a733d386256172565b4caa271e47d

SHA1
f2c6cc68cf2129ab7e81ad717030f86d4e419e45

SHA256
8d9ee65a9ca9a24dfd3a68f312c776eeb546e3ad9111babb60d5903c32a8667b

SHA512
733bfd08ef90e014bd19aebb3f4013222b6227e066dce0d2043e537ace7ae12273a3215b65f34e16e45f718414d252f6a90942c7ac1002d5d039be996e2eedcd

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
\Users\Admin\AppData\Local\Temp\nsy14AC.tmp\AdvSplash.dll

Filesize
6KB

MD5
a1bba35c752b36f575350cb7ddf238e4

SHA1
9603b691ae71d4fbc7a14dbb837bd97cecac8aab

SHA256
0667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6

SHA512
eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1312-74-0x0000000000400000-0x0000000000737000-memory.dmp

Filesize
3.2MB

Download
memory/1312-75-0x0000000000D00000-0x0000000001037000-memory.dmp

Filesize
3.2MB

Download
memory/1312-76-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/1312-91-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/1312-90-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1312-58-0x0000000000000000-mapping.dmp

Download
memory/1664-54-0x0000000075581000-0x0000000075583000-memory.dmp

Filesize
8KB

Download
memory/1664-62-0x0000000002EF0000-0x0000000003227000-memory.dmp

Filesize
3.2MB

Download
memory/1664-60-0x0000000002EF0000-0x0000000003227000-memory.dmp

Filesize
3.2MB

Download
memory/1972-79-0x0000000000000000-mapping.dmp

Download
memory/1972-88-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2032-84-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2032-81-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2032-83-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/2032-77-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2032-92-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2032-68-0x0000000000000000-mapping.dmp

Download