ramnit | 68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638

Analysis

max time kernel
122s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe
Size

111KB
MD5

50341b4a7b2b3a7d2338348c5a419320
SHA1

920ae502b107d359bfc51c1328200001f2d0866e
SHA256

68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638
SHA512

476a4fd366d1b8f34607eb5bf3997faba271815086e56b5f24eb6ba8d945c56118f160a223f4ff18998535809745c3f99f9c7994feca188710f0cba00bc21945
SSDEEP

1536:4+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzEObzzYJV72x14IKupSQV8g5y:TROzoTq0+RO7IwnYJJV71WSQVlN

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 4 IoCs

pid	Process
1984	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe
1612	DesktopLayer.exe
1540	DesktopLayer.exe
1096	DesktopLayerSrv.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000005c50-55.dat	upx
behavioral1/files/0x0007000000005c50-57.dat	upx
behavioral1/files/0x0007000000005c50-59.dat	upx
behavioral1/files/0x000a000000013382-60.dat	upx
behavioral1/files/0x000a000000013382-63.dat	upx
behavioral1/files/0x000a000000013382-70.dat	upx
behavioral1/files/0x000a000000013382-68.dat	upx
behavioral1/memory/1984-67-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1452-66-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/files/0x000a000000013382-62.dat	upx
behavioral1/files/0x000a000000013382-61.dat	upx
behavioral1/files/0x00070000000133a7-72.dat	upx
behavioral1/files/0x00070000000133a7-74.dat	upx
behavioral1/files/0x00070000000133a7-76.dat	upx
behavioral1/memory/1612-77-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1096-78-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe
1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe
1984	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe
1540	DesktopLayer.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px6DA2.tmp	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px6DA2.tmp	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px6F28.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFFF5BD1-4447-11ED-B98A-FAB5137186BE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFFF34C1-4447-11ED-B98A-FAB5137186BE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFFFA9F1-4447-11ED-B98A-FAB5137186BE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371696126"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1612	DesktopLayer.exe
1612	DesktopLayer.exe
1540	DesktopLayer.exe
1540	DesktopLayer.exe
1540	DesktopLayer.exe
1612	DesktopLayer.exe
1540	DesktopLayer.exe
1612	DesktopLayer.exe
1096	DesktopLayerSrv.exe
1096	DesktopLayerSrv.exe
1096	DesktopLayerSrv.exe
1096	DesktopLayerSrv.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1648	iexplore.exe
1184	iexplore.exe
964	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1184	iexplore.exe
1184	iexplore.exe
964	iexplore.exe
964	iexplore.exe
1648	iexplore.exe
1648	iexplore.exe
560	IEXPLORE.EXE
1744	IEXPLORE.EXE
1868	IEXPLORE.EXE
560	IEXPLORE.EXE
1744	IEXPLORE.EXE
1868	IEXPLORE.EXE
560	IEXPLORE.EXE
560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1984	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	26
PID 1452 wrote to memory of 1984	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	26
PID 1452 wrote to memory of 1984	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	26
PID 1452 wrote to memory of 1984	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	26
PID 1452 wrote to memory of 1540	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	27
PID 1452 wrote to memory of 1540	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	27
PID 1452 wrote to memory of 1540	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	27
PID 1452 wrote to memory of 1540	1452	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe	27
PID 1984 wrote to memory of 1612	1984	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe	28
PID 1984 wrote to memory of 1612	1984	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe	28
PID 1984 wrote to memory of 1612	1984	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe	28
PID 1984 wrote to memory of 1612	1984	68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe	28
PID 1540 wrote to memory of 1096	1540	DesktopLayer.exe	29
PID 1540 wrote to memory of 1096	1540	DesktopLayer.exe	29
PID 1540 wrote to memory of 1096	1540	DesktopLayer.exe	29
PID 1540 wrote to memory of 1096	1540	DesktopLayer.exe	29
PID 1540 wrote to memory of 1648	1540	DesktopLayer.exe	30
PID 1540 wrote to memory of 1648	1540	DesktopLayer.exe	30
PID 1540 wrote to memory of 1648	1540	DesktopLayer.exe	30
PID 1540 wrote to memory of 1648	1540	DesktopLayer.exe	30
PID 1612 wrote to memory of 964	1612	DesktopLayer.exe	31
PID 1612 wrote to memory of 964	1612	DesktopLayer.exe	31
PID 1612 wrote to memory of 964	1612	DesktopLayer.exe	31
PID 1612 wrote to memory of 964	1612	DesktopLayer.exe	31
PID 1096 wrote to memory of 1184	1096	DesktopLayerSrv.exe	32
PID 1096 wrote to memory of 1184	1096	DesktopLayerSrv.exe	32
PID 1096 wrote to memory of 1184	1096	DesktopLayerSrv.exe	32
PID 1096 wrote to memory of 1184	1096	DesktopLayerSrv.exe	32
PID 1184 wrote to memory of 1744	1184	iexplore.exe	35
PID 1648 wrote to memory of 560	1648	iexplore.exe	34
PID 1648 wrote to memory of 560	1648	iexplore.exe	34
PID 1648 wrote to memory of 560	1648	iexplore.exe	34
PID 1184 wrote to memory of 1744	1184	iexplore.exe	35
PID 1184 wrote to memory of 1744	1184	iexplore.exe	35
PID 1648 wrote to memory of 560	1648	iexplore.exe	34
PID 1184 wrote to memory of 1744	1184	iexplore.exe	35
PID 964 wrote to memory of 1868	964	iexplore.exe	36
PID 964 wrote to memory of 1868	964	iexplore.exe	36
PID 964 wrote to memory of 1868	964	iexplore.exe	36
PID 964 wrote to memory of 1868	964	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe
"C:\Users\Admin\AppData\Local\Temp\68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe
  C:\Users\Admin\AppData\Local\Temp\68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:964 CREDAT:275457 /prefetch:2
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1868
- C:\Program Files (x86)\Microsoft\DesktopLayer.exe
  "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1744
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
50341b4a7b2b3a7d2338348c5a419320

SHA1
920ae502b107d359bfc51c1328200001f2d0866e

SHA256
68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638

SHA512
476a4fd366d1b8f34607eb5bf3997faba271815086e56b5f24eb6ba8d945c56118f160a223f4ff18998535809745c3f99f9c7994feca188710f0cba00bc21945

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
50341b4a7b2b3a7d2338348c5a419320

SHA1
920ae502b107d359bfc51c1328200001f2d0866e

SHA256
68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638

SHA512
476a4fd366d1b8f34607eb5bf3997faba271815086e56b5f24eb6ba8d945c56118f160a223f4ff18998535809745c3f99f9c7994feca188710f0cba00bc21945

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
50341b4a7b2b3a7d2338348c5a419320

SHA1
920ae502b107d359bfc51c1328200001f2d0866e

SHA256
68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638

SHA512
476a4fd366d1b8f34607eb5bf3997faba271815086e56b5f24eb6ba8d945c56118f160a223f4ff18998535809745c3f99f9c7994feca188710f0cba00bc21945

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
50341b4a7b2b3a7d2338348c5a419320

SHA1
920ae502b107d359bfc51c1328200001f2d0866e

SHA256
68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638

SHA512
476a4fd366d1b8f34607eb5bf3997faba271815086e56b5f24eb6ba8d945c56118f160a223f4ff18998535809745c3f99f9c7994feca188710f0cba00bc21945

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EFFF34C1-4447-11ED-B98A-FAB5137186BE}.dat

Filesize
3KB

MD5
853cc1b5d46508eed62744c4c6bd2cc2

SHA1
2a8c7143f74c1ed175ace2f268470d9c302b38e6

SHA256
c9c70f18a48ea75cc71e42d4565d1c1363db03a3edc5aa6eecf6f3adb65d42b5

SHA512
c79bd373389d701813ac1c47d1990cca84423b997a5dbe97b5a4f25f8347a445ea58861a339991e5d63ce2ac6981e493d985ca6d099e9ae3d3f358d65a9a9674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EFFFA9F1-4447-11ED-B98A-FAB5137186BE}.dat

Filesize
3KB

MD5
7b60e30ed4cc981613940fc5a0491985

SHA1
bee5e9e5d4a06f8128a2b71ddad497728a5bbc57

SHA256
a22d6eb0a35791ea5f8d8f5a022893ce01c9c85ded783d288dcb2a71e29bab7b

SHA512
7ae173f3925bd1e5dc4607893ee14886dfd96e1cac3bfbe9c932422e7d1afafae953e360b424da09151f688a466fd5a5c851b28692b1d10785d0aa9f0d12125c

Download Submit
C:\Users\Admin\AppData\Local\Temp\68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7STV4046.txt

Filesize
606B

MD5
6f0f9248446b567173c15220cb588919

SHA1
e53b3d7d4aa1a589e3822d23d779b70511b10d76

SHA256
1bd70509271af8f2e5ec2a9bb60875920fbfb0d55d2cdfb7cfbbbc14363ccf4b

SHA512
686becbc8128a654b634d7d728581c7687b2890c21b52107acfca0f359e612aa4018f8440f585e0f1db64c867c84cfe25346f82277ad66257719b66813cbfa70

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
50341b4a7b2b3a7d2338348c5a419320

SHA1
920ae502b107d359bfc51c1328200001f2d0866e

SHA256
68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638

SHA512
476a4fd366d1b8f34607eb5bf3997faba271815086e56b5f24eb6ba8d945c56118f160a223f4ff18998535809745c3f99f9c7994feca188710f0cba00bc21945

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
111KB

MD5
50341b4a7b2b3a7d2338348c5a419320

SHA1
920ae502b107d359bfc51c1328200001f2d0866e

SHA256
68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638

SHA512
476a4fd366d1b8f34607eb5bf3997faba271815086e56b5f24eb6ba8d945c56118f160a223f4ff18998535809745c3f99f9c7994feca188710f0cba00bc21945

Download Submit
\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\68f14eccee33d195b083273a09b22020a9c72b1c9e53aa68d3fe7e44c3e0b638Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1096-78-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1452-54-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1452-66-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1612-77-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1984-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download