ramnit | 5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640

General

Target

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
Size

63KB
MD5

45719d29d45b105b7e7039aa8583d321
SHA1

ad010ac4be747184f67153ec6b3bb474a0f52b2f
SHA256

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640
SHA512

38e782f28f5dd51f4c751335f0fa2387cd2ebe299b2effb29861c475c4d518b4875177db7010981da2af4de1162f7f5425374eb29d2f5ccb8654ae668130409e
SSDEEP

768:o06R0UEgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9IC9:mR0In3Pc0LCH9MtbvabUDzJYWu3BU

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

WaterMark.exe

pid process

1780 WaterMark.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4764-134-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4764-135-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4764-139-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1780-144-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1780-145-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1780-146-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1780-151-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1780-152-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1780-153-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1780-154-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxE3CD.tmp	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3676 4460 WerFault.exe svchost.exe

pid	pid_target	process	target process
3676	4460	WerFault.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1603276870"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1603581145"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1603581145"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998427"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376014523"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1603276870"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1615300268"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8B0763F4-6B8E-11ED-A0EE-5E349B7DFDEC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998427"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998427"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8B0E8A08-6B8E-11ED-A0EE-5E349B7DFDEC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998427"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998427"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998427"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1615300268"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

WaterMark.exe

pid	process
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe
1780	WaterMark.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

560 iexplore.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WaterMark.exe

description pid process

Token: SeDebugPrivilege 1780 WaterMark.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

560 iexplore.exe
4932 iexplore.exe

pid	process
560	iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1780	WaterMark.exe

pid	process
560	iexplore.exe
4932	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
4932	iexplore.exe
4932	iexplore.exe
560	iexplore.exe
560	iexplore.exe
4016	IEXPLORE.EXE
4016	IEXPLORE.EXE
3204	IEXPLORE.EXE
3204	IEXPLORE.EXE
4016	IEXPLORE.EXE
4016	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

Processes:

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exeWaterMark.exe

pid process

4764 5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
1780 WaterMark.exe

pid	process
4764	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
1780	WaterMark.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exeWaterMark.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 4764 wrote to memory of 1780	4764	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe	WaterMark.exe
PID 4764 wrote to memory of 1780	4764	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe	WaterMark.exe
PID 4764 wrote to memory of 1780	4764	5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe	WaterMark.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 4460	1780	WaterMark.exe	svchost.exe
PID 1780 wrote to memory of 560	1780	WaterMark.exe	iexplore.exe
PID 1780 wrote to memory of 560	1780	WaterMark.exe	iexplore.exe
PID 1780 wrote to memory of 4932	1780	WaterMark.exe	iexplore.exe
PID 1780 wrote to memory of 4932	1780	WaterMark.exe	iexplore.exe
PID 4932 wrote to memory of 3204	4932	iexplore.exe	IEXPLORE.EXE
PID 4932 wrote to memory of 3204	4932	iexplore.exe	IEXPLORE.EXE
PID 4932 wrote to memory of 3204	4932	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 4016	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 4016	560	iexplore.exe	IEXPLORE.EXE
PID 560 wrote to memory of 4016	560	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe
"C:\Users\Admin\AppData\Local\Temp\5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4764

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 204
4⤵
- Program crash
PID:3676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:560 CREDAT:17410 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4932 CREDAT:17410 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4460 -ip 4460
1⤵
PID:4368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe
Filesize
63KB

MD5
45719d29d45b105b7e7039aa8583d321

SHA1
ad010ac4be747184f67153ec6b3bb474a0f52b2f

SHA256
5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640

SHA512
38e782f28f5dd51f4c751335f0fa2387cd2ebe299b2effb29861c475c4d518b4875177db7010981da2af4de1162f7f5425374eb29d2f5ccb8654ae668130409e

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe
Filesize
63KB

MD5
45719d29d45b105b7e7039aa8583d321

SHA1
ad010ac4be747184f67153ec6b3bb474a0f52b2f

SHA256
5b25f5c707386a572c496b5b3eb0fcbf8829b8bf11cec0caeda66ee7ad01a640

SHA512
38e782f28f5dd51f4c751335f0fa2387cd2ebe299b2effb29861c475c4d518b4875177db7010981da2af4de1162f7f5425374eb29d2f5ccb8654ae668130409e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
e32d02ce684c01ef3af05fae9066160e

SHA1
29c7a6e8ed553ac2765634265d1db041d6d422ec

SHA256
b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

SHA512
e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
e32d02ce684c01ef3af05fae9066160e

SHA1
29c7a6e8ed553ac2765634265d1db041d6d422ec

SHA256
b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

SHA512
e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
8208e62f9e9410718ab977459a468ef4

SHA1
32f165d7bd74d976daa49e8f6955ab354a080477

SHA256
a08b7246c78681334ec1247eda3d33ef9e880e98fa52bd1b3d3caad6ce48cf28

SHA512
0ddf40e81cc1ea1804dcbbbbb82ef5aa8b6a91cb317d749dc0e42d393cdb23e0db6a4ab7c794f8b97bd4b888b205b206e8e8df5d354d1c6c8aefbb60ed5985c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
8208e62f9e9410718ab977459a468ef4

SHA1
32f165d7bd74d976daa49e8f6955ab354a080477

SHA256
a08b7246c78681334ec1247eda3d33ef9e880e98fa52bd1b3d3caad6ce48cf28

SHA512
0ddf40e81cc1ea1804dcbbbbb82ef5aa8b6a91cb317d749dc0e42d393cdb23e0db6a4ab7c794f8b97bd4b888b205b206e8e8df5d354d1c6c8aefbb60ed5985c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8B0763F4-6B8E-11ED-A0EE-5E349B7DFDEC}.dat
Filesize
5KB

MD5
b2fb82cc729564294a05ce34da0d7db8

SHA1
804a861dab4487328a098bffa3b3a01ddeda6351

SHA256
42e54d202854d48e5b7f3437204a6d08f9829fb196589418ec419af4dc85d955

SHA512
50ed0bc371d2bd826c8866c8a0f292308e71b7794f1815b25f6f214f3ac3dcff1bb20dce3a1791385973588ffcfe7179ab6472deebb73cb9cd34e75df1993168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8B0E8A08-6B8E-11ED-A0EE-5E349B7DFDEC}.dat
Filesize
3KB

MD5
dadb5368801128a1ac995e020010daac

SHA1
a9e9aaca844e673daaa38d171205bcf1d07efb6c

SHA256
0efaa24ccde3536c98b4653eafed016c60e7be847518c46da8b5e1aa214ad431

SHA512
27c8f92edcd197fc40228f93e044fafaac86ac8b0013801c9bd994d6d4a6e83362ccbde2f0c880e556debd4f672946b8f8668c8cea2cb2df4844e222303e99f5

Download Submit
memory/1780-154-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1780-146-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1780-145-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1780-151-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1780-152-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1780-153-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1780-144-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1780-136-0x0000000000000000-mapping.dmp

Download
memory/4460-148-0x0000000000000000-mapping.dmp

Download
memory/4764-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4764-139-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4764-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads