ramnit | d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db

Analysis

max time kernel
136s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe
Size

111KB
MD5

df84ba3e887c3458a21c29063f01faa0
SHA1

cd1ced4d3296ffa57ecc911523dee8544bd23f7b
SHA256

d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db
SHA512

522753ea75048341dd36db7434fb98db5284026f7f92d5065373f729c19b28fb50aeaf2eddbfb66120e209eb0914705a9448309b354e7c7b47bef9c0d5d8b107
SSDEEP

3072:TROzoTq0+RO7IwnYePnIfKLyD23htKFHY6S:1kdNwBT/n3hwK6S

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 3 IoCs

Processes:

d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exeDesktopLayer.exeDesktopLayerSrv.exe

pid process

4956 d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
444 DesktopLayer.exe
648 DesktopLayerSrv.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe	upx
behavioral2/memory/4152-134-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/memory/4956-135-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx
behavioral2/memory/4152-144-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/memory/4956-145-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/444-147-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/memory/648-146-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx

Drops file in Program Files directory 8 IoCs

Processes:

d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exed35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exeDesktopLayer.exeDesktopLayerSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxFDDD.tmp	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxFDDE.tmp	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxFFF0.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3686311997"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999386"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{04601A9A-6F4E-11ED-A0EE-CE8FEF2919E2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999386"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999386"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3686311997"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3648187632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999386"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3648187632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3686311997"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999386"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3648187632"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3648187632"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999386"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{045DB69A-6F4E-11ED-A0EE-CE8FEF2919E2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{04411EF0-6F4E-11ED-A0EE-CE8FEF2919E2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999386"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376426617"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exeDesktopLayer.exeDesktopLayerSrv.exe

pid	process
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
444	DesktopLayer.exe
444	DesktopLayer.exe
444	DesktopLayer.exe
444	DesktopLayer.exe
444	DesktopLayer.exe
648	DesktopLayerSrv.exe
444	DesktopLayer.exe
648	DesktopLayerSrv.exe
444	DesktopLayer.exe
444	DesktopLayer.exe
648	DesktopLayerSrv.exe
648	DesktopLayerSrv.exe
648	DesktopLayerSrv.exe
648	DesktopLayerSrv.exe
648	DesktopLayerSrv.exe
648	DesktopLayerSrv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1036 iexplore.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exe

pid process

1036 iexplore.exe
4920 iexplore.exe
1124 iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1036	iexplore.exe
1036	iexplore.exe
1124	iexplore.exe
1124	iexplore.exe
4920	iexplore.exe
4920	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exed35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exeDesktopLayer.exeDesktopLayerSrv.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 4152 wrote to memory of 4956	4152	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
PID 4152 wrote to memory of 4956	4152	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
PID 4152 wrote to memory of 4956	4152	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
PID 4956 wrote to memory of 4920	4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe	iexplore.exe
PID 4956 wrote to memory of 4920	4956	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe	iexplore.exe
PID 4152 wrote to memory of 444	4152	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe	DesktopLayer.exe
PID 4152 wrote to memory of 444	4152	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe	DesktopLayer.exe
PID 4152 wrote to memory of 444	4152	d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe	DesktopLayer.exe
PID 444 wrote to memory of 648	444	DesktopLayer.exe	DesktopLayerSrv.exe
PID 444 wrote to memory of 648	444	DesktopLayer.exe	DesktopLayerSrv.exe
PID 444 wrote to memory of 648	444	DesktopLayer.exe	DesktopLayerSrv.exe
PID 444 wrote to memory of 1124	444	DesktopLayer.exe	iexplore.exe
PID 444 wrote to memory of 1124	444	DesktopLayer.exe	iexplore.exe
PID 648 wrote to memory of 1036	648	DesktopLayerSrv.exe	iexplore.exe
PID 648 wrote to memory of 1036	648	DesktopLayerSrv.exe	iexplore.exe
PID 1124 wrote to memory of 2240	1124	iexplore.exe	IEXPLORE.EXE
PID 1124 wrote to memory of 2240	1124	iexplore.exe	IEXPLORE.EXE
PID 1124 wrote to memory of 2240	1124	iexplore.exe	IEXPLORE.EXE
PID 1036 wrote to memory of 2260	1036	iexplore.exe	IEXPLORE.EXE
PID 1036 wrote to memory of 2260	1036	iexplore.exe	IEXPLORE.EXE
PID 1036 wrote to memory of 2260	1036	iexplore.exe	IEXPLORE.EXE
PID 4920 wrote to memory of 1396	4920	iexplore.exe	IEXPLORE.EXE
PID 4920 wrote to memory of 1396	4920	iexplore.exe	IEXPLORE.EXE
PID 4920 wrote to memory of 1396	4920	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe
"C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4152

C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4920 CREDAT:17410 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:444

C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:648

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:17410 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
111KB

MD5
df84ba3e887c3458a21c29063f01faa0

SHA1
cd1ced4d3296ffa57ecc911523dee8544bd23f7b

SHA256
d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db

SHA512
522753ea75048341dd36db7434fb98db5284026f7f92d5065373f729c19b28fb50aeaf2eddbfb66120e209eb0914705a9448309b354e7c7b47bef9c0d5d8b107

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
111KB

MD5
df84ba3e887c3458a21c29063f01faa0

SHA1
cd1ced4d3296ffa57ecc911523dee8544bd23f7b

SHA256
d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3db

SHA512
522753ea75048341dd36db7434fb98db5284026f7f92d5065373f729c19b28fb50aeaf2eddbfb66120e209eb0914705a9448309b354e7c7b47bef9c0d5d8b107

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
dedb504b3469b24ec0df79c68f5772e2

SHA1
177a8b1045b456316ca32d90aba942bf34774c64

SHA256
e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

SHA512
101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
dedb504b3469b24ec0df79c68f5772e2

SHA1
177a8b1045b456316ca32d90aba942bf34774c64

SHA256
e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

SHA512
101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
8adfefbce783bf923ddcf376a9921f84

SHA1
9d355b3d3c1a8e53ebe94f65ba8d2c4992e76d62

SHA256
7c7589d311efb832657abe528ca71be782498d757bb5c8db8ea821985776e437

SHA512
616ff4bba141d9b942f89681bc5232ae3269da34967559be1f78f84cac4d9a70305842045d50de0933828dbfdf7e871283ce7efeaf73816048e1d9ac9a009920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
8adfefbce783bf923ddcf376a9921f84

SHA1
9d355b3d3c1a8e53ebe94f65ba8d2c4992e76d62

SHA256
7c7589d311efb832657abe528ca71be782498d757bb5c8db8ea821985776e437

SHA512
616ff4bba141d9b942f89681bc5232ae3269da34967559be1f78f84cac4d9a70305842045d50de0933828dbfdf7e871283ce7efeaf73816048e1d9ac9a009920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
434B

MD5
8adfefbce783bf923ddcf376a9921f84

SHA1
9d355b3d3c1a8e53ebe94f65ba8d2c4992e76d62

SHA256
7c7589d311efb832657abe528ca71be782498d757bb5c8db8ea821985776e437

SHA512
616ff4bba141d9b942f89681bc5232ae3269da34967559be1f78f84cac4d9a70305842045d50de0933828dbfdf7e871283ce7efeaf73816048e1d9ac9a009920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{04411EF0-6F4E-11ED-A0EE-CE8FEF2919E2}.dat
Filesize
5KB

MD5
e5bd95147df39034f988a5040faefc30

SHA1
4f7e10b100cbdb3a29429194cf7efc79029f5e6f

SHA256
46f6b197124c0a5ceb558dd38ecba97fa176742fa104a24cf5557db09d7a44a5

SHA512
dc61bd0a165c26cc559dc5f295331893fb59b63838b1dfddbc7407fb5d9e68c4fe4e472466528ce50b9dcda3db586da1c8c0a07e7ca8f9367dedb3d68d87d364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{045DB69A-6F4E-11ED-A0EE-CE8FEF2919E2}.dat
Filesize
3KB

MD5
4999822f016ea7498611387c53b38efb

SHA1
0927d156e6c56114ba41691f67b0520105b2e038

SHA256
a5562a31e8a1fa9569719442a1bfd14ef5576939c9cd36823b9cd531b96b1f19

SHA512
a8de935732462b6168b365da149ae5837f81bfe232314a118de10ec959b08e00486ed31b1840698dbb4b25a3a3192d96995e748178de3b97d86c16f4ea791605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{04601A9A-6F4E-11ED-A0EE-CE8FEF2919E2}.dat
Filesize
5KB

MD5
6a4f87a7758109709fb73bb60b9e3616

SHA1
17161fb44c2d1c4dd1d9aedffd7ac2c55f65aa70

SHA256
46e77923b5fe042f9e166b6592579da8e8ef86bd88fb64d2690f9f3c5060e8e8

SHA512
f11f24cac57fd1c41b02db3c380d931f03869c376768005d2493946b3ab69e938f9f73658b18e68a49675a80208116f5cefbfb86da79e6a58b7a90272713d75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\d35fd7563c9934bb3af410bd31c388519af1aedba014b3c1f4a4e7efc581a3dbSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/444-138-0x0000000000000000-mapping.dmp

Download
memory/444-147-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/648-146-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/648-140-0x0000000000000000-mapping.dmp

Download
memory/4152-144-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4152-136-0x00000000006A0000-0x00000000006AF000-memory.dmp

Filesize
60KB

Download
memory/4152-134-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4956-145-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4956-132-0x0000000000000000-mapping.dmp

Download
memory/4956-135-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download