ramnit | 2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22-06-2022 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
Size

6.2MB
MD5

0fe34c125e732e7410d5135ee5c35d18
SHA1

4b5e14fafd6b427ab565f3060bf22c075b564ff7
SHA256

2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf
SHA512

f25e0f92d84fe7682e1547eeae8d0781015732752fc4c6706e9a9687efc21d68916fbd638f7b87538b5931dd935f143ca8638b488ddc0a0d544d66ece1fff272

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 6 IoCs

Processes:

2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exeDesktopLayer.exe2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exeDesktopLayer.exe2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exeDesktopLayer.exe

pid	process
2108	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
3388	DesktopLayer.exe
996	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
4648	DesktopLayer.exe
100	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
3548	DesktopLayer.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/2108-136-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3388-138-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\nsRandom.dll	upx
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\nsRandom.dll	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/3388-142-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx

Loads dropped DLL 11 IoCs

Processes:

2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe

pid	process
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe

Drops file in Program Files directory 7 IoCs

Processes:

2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxC633.tmp	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxC902.tmp	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBDF6.tmp	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4092	2316	WerFault.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
2228	2316	WerFault.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30967354"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30967354"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "40439414"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362668615"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "53877024"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30967354"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "40439414"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2DDE201B-F22D-11EC-AD90-7E9F925D3B67} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

DesktopLayer.exeDesktopLayer.exeDesktopLayer.exe

pid	process
3388	DesktopLayer.exe
3388	DesktopLayer.exe
3388	DesktopLayer.exe
3388	DesktopLayer.exe
3388	DesktopLayer.exe
3388	DesktopLayer.exe
3388	DesktopLayer.exe
3388	DesktopLayer.exe
4648	DesktopLayer.exe
4648	DesktopLayer.exe
4648	DesktopLayer.exe
4648	DesktopLayer.exe
4648	DesktopLayer.exe
4648	DesktopLayer.exe
4648	DesktopLayer.exe
4648	DesktopLayer.exe
3548	DesktopLayer.exe
3548	DesktopLayer.exe
3548	DesktopLayer.exe
3548	DesktopLayer.exe
3548	DesktopLayer.exe
3548	DesktopLayer.exe
3548	DesktopLayer.exe
3548	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

4884 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4884 iexplore.exe

pid	process
4884	iexplore.exe

pid	process
4884	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exeiexplore.exeIEXPLORE.EXE

pid	process
2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
4884	iexplore.exe
4884	iexplore.exe
216	IEXPLORE.EXE
216	IEXPLORE.EXE
216	IEXPLORE.EXE
216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exeDesktopLayer.exe2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exeDesktopLayer.exeiexplore.exe2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exeDesktopLayer.exe

description	pid	process	target process
PID 2316 wrote to memory of 2108	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 2316 wrote to memory of 2108	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 2316 wrote to memory of 2108	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 2108 wrote to memory of 3388	2108	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 2108 wrote to memory of 3388	2108	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 2108 wrote to memory of 3388	2108	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 3388 wrote to memory of 4884	3388	DesktopLayer.exe	iexplore.exe
PID 3388 wrote to memory of 4884	3388	DesktopLayer.exe	iexplore.exe
PID 2316 wrote to memory of 996	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 2316 wrote to memory of 996	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 2316 wrote to memory of 996	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 996 wrote to memory of 4648	996	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 996 wrote to memory of 4648	996	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 996 wrote to memory of 4648	996	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 4648 wrote to memory of 1900	4648	DesktopLayer.exe	iexplore.exe
PID 4648 wrote to memory of 1900	4648	DesktopLayer.exe	iexplore.exe
PID 4884 wrote to memory of 216	4884	iexplore.exe	IEXPLORE.EXE
PID 4884 wrote to memory of 216	4884	iexplore.exe	IEXPLORE.EXE
PID 4884 wrote to memory of 216	4884	iexplore.exe	IEXPLORE.EXE
PID 2316 wrote to memory of 100	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 2316 wrote to memory of 100	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 2316 wrote to memory of 100	2316	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
PID 100 wrote to memory of 3548	100	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 100 wrote to memory of 3548	100	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 100 wrote to memory of 3548	100	2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe	DesktopLayer.exe
PID 3548 wrote to memory of 2584	3548	DesktopLayer.exe	iexplore.exe
PID 3548 wrote to memory of 2584	3548	DesktopLayer.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe
"C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2108

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4884 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:216

C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:996

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
PID:1900

C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:100

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1272
2⤵
- Program crash
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1272
2⤵
- Program crash
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2316 -ip 2316
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2316 -ip 2316
1⤵
PID:4492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
92488b432174ef5c253c389d46ac8160

SHA1
0e1366585e95a46303f7ad7828a07d5564814ab8

SHA256
10c33c46e15c81056e94e5109cf3e26275bd1c706179abe6054df45e8a0d7551

SHA512
6d5615ebad8ed456fcba46524c6cc1c6482cd4bf8d04a9a52419d2c1c3ce3549632eb552cbf37025436977e06f645e68db576ca4c830e5ee3e66353872322e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
eaadaf6a452b8bcb422bc70a40d5cc59

SHA1
fc05091ac89f693734ee890c9822233c2eb1fa41

SHA256
6c2f76a1f74fcee67423680e7f8201f3944bba19ace1a6ef3ffb0628827a4325

SHA512
6e1ef1f6382c3dca10fbeeeca5faf06f76589a5dfc267bf88e7feceff7c99f66b068817be3c1b82fbf55e6b1aaa7011232b3bedbedd4d49772e71a80208b1e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1968847\MyNsisSkin.dll
Filesize
384KB

MD5
bf8624dd749fcd34042da56f412c3e21

SHA1
4b9f939c342af6fcd7eb02a6fb5aced062b0c7ef

SHA256
1298994ddf1de1c9876ad886b613ac8668d1d9d805123bfe63d60dc92ae1b538

SHA512
43914e3cc5a822d434859d47147a40e72ab562a4f07aca16d8ed7b7660a3ae60fdaba3d855338067e481bb2acd8db9e258e437a3e5ea73f44d09d7395b0f431c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1968847\MyNsisSkin.dll
Filesize
384KB

MD5
bf8624dd749fcd34042da56f412c3e21

SHA1
4b9f939c342af6fcd7eb02a6fb5aced062b0c7ef

SHA256
1298994ddf1de1c9876ad886b613ac8668d1d9d805123bfe63d60dc92ae1b538

SHA512
43914e3cc5a822d434859d47147a40e72ab562a4f07aca16d8ed7b7660a3ae60fdaba3d855338067e481bb2acd8db9e258e437a3e5ea73f44d09d7395b0f431c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e1241e9ef1417a857892aaa1705cf89f5759bcf8f7b33e61cd19ca33fc7c4cfSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\ButtonEvent.dll
Filesize
4KB

MD5
fad9d09fc0267e8513b8628e767b2604

SHA1
bea76a7621c07b30ed90bedef4d608a5b9e15300

SHA256
5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

SHA512
b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\ButtonEvent.dll
Filesize
4KB

MD5
fad9d09fc0267e8513b8628e767b2604

SHA1
bea76a7621c07b30ed90bedef4d608a5b9e15300

SHA256
5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

SHA512
b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\MyNsisExtend.dll
Filesize
596KB

MD5
6040db1da245c3cab9afedbc5354c0ac

SHA1
1acbd486cd536b5f46d57a5f444c07b9082585e8

SHA256
7c213725d242bc07c27859697f9d8b1edce6769fad64ce3f55e7fe89041c467d

SHA512
a58793278ee299e05f44bc63db087df1d381738033acb6053bb7e2e285bb62729507b72bd89adc0974c41f27ec3033db229c84035c4cbf8d28391bc9274b1fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\MyNsisExtend.dll
Filesize
596KB

MD5
6040db1da245c3cab9afedbc5354c0ac

SHA1
1acbd486cd536b5f46d57a5f444c07b9082585e8

SHA256
7c213725d242bc07c27859697f9d8b1edce6769fad64ce3f55e7fe89041c467d

SHA512
a58793278ee299e05f44bc63db087df1d381738033acb6053bb7e2e285bb62729507b72bd89adc0974c41f27ec3033db229c84035c4cbf8d28391bc9274b1fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\System.dll
Filesize
67KB

MD5
fd52c2b9314cf3baab19213ffe358e32

SHA1
7cdd39c03c20fcb17034ab46fed0bdb7e9f4e964

SHA256
fe91ad0da776e7e20f524afa0f94f36d08c436f9ceb632cecd2e8b0fc252ee99

SHA512
28d10765b88dd3e38d82f48de447774cea7cf57513d38d1feac39c1f8282658b16ee0510c8dc45f22167bdacfc963ae1f0d8defcacf578456536a5ea13dd2a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\nsDialogs.dll
Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\nsRandom.dll
Filesize
77KB

MD5
1ab62d438f2f0066503c3c4f6ee93a9c

SHA1
b0d3af7d801cb12f68484e7adb7ebaa3980e3fbf

SHA256
ec30a85f07692ee579cb6fcd0a90e027c6c6f1a1c1805682f70b02d2e6a23e1c

SHA512
405c4f971ebb4bb7aca09501e52dec01c62f8c8e79d130a1fd47243507ec2706eae45ccbedff537e853133e237e52a4388cd7420a0687f56713445ed6eb05a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqBD8A.tmp\nsRandom.dll
Filesize
77KB

MD5
1ab62d438f2f0066503c3c4f6ee93a9c

SHA1
b0d3af7d801cb12f68484e7adb7ebaa3980e3fbf

SHA256
ec30a85f07692ee579cb6fcd0a90e027c6c6f1a1c1805682f70b02d2e6a23e1c

SHA512
405c4f971ebb4bb7aca09501e52dec01c62f8c8e79d130a1fd47243507ec2706eae45ccbedff537e853133e237e52a4388cd7420a0687f56713445ed6eb05a5c

Download Submit
memory/100-161-0x0000000000000000-mapping.dmp

Download
memory/996-147-0x0000000000000000-mapping.dmp

Download
memory/2108-131-0x0000000000000000-mapping.dmp

Download
memory/2108-136-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2316-155-0x00000000022B0000-0x00000000022D1000-memory.dmp

Filesize
132KB

Download
memory/2316-159-0x00000000030D0000-0x000000000316A000-memory.dmp

Filesize
616KB

Download
memory/2316-154-0x00000000022B0000-0x00000000022D1000-memory.dmp

Filesize
132KB

Download
memory/2316-153-0x0000000002F60000-0x0000000002FC2000-memory.dmp

Filesize
392KB

Download
memory/2316-168-0x0000000004411000-0x0000000004413000-memory.dmp

Filesize
8KB

Download
memory/2316-137-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2316-156-0x0000000002F60000-0x0000000002FC2000-memory.dmp

Filesize
392KB

Download
memory/2316-170-0x00000000030D0000-0x000000000316A000-memory.dmp

Filesize
616KB

Download
memory/2316-173-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2316-174-0x0000000002F60000-0x0000000002FC2000-memory.dmp

Filesize
392KB

Download
memory/3388-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3388-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3388-134-0x0000000000000000-mapping.dmp

Download
memory/3548-164-0x0000000000000000-mapping.dmp

Download
memory/4648-150-0x0000000000000000-mapping.dmp

Download