ramnit | d8fc585e9ef6f11be19bd285bc2295f68bb5baaeab9b5e0c7322ca264e60e910

Analysis

max time kernel
129s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 21:49 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21dbca0cbb0de0d7492ca39593a2940d_JaffaCakes118.html
Size

158KB
MD5

21dbca0cbb0de0d7492ca39593a2940d
SHA1

2c653b0d7ee37af2ff272ca11be9439d5fbe64c1
SHA256

d8fc585e9ef6f11be19bd285bc2295f68bb5baaeab9b5e0c7322ca264e60e910
SHA512

73ceeee40ce51210ce98c5ebafdae82add5b44fad51ea3eef25b2ce886c5ddec04079ec82de5d3186f44e4d40b49ed5a69b189031a06b09a8539785b22ae9f33
SSDEEP

1536:iyRTGlOuHiruhFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:iAViFyfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
1008	svchost.exe
2260	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2928	IEXPLORE.EXE
1008	svchost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002e000000004ed7-476.dat	upx
behavioral1/memory/1008-482-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2260-493-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2260-491-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2260-490-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxDCF7.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421280430"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA112251-0CBB-11EF-A0EE-F2EF6E19F123} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2260	DesktopLayer.exe
2260	DesktopLayer.exe
2260	DesktopLayer.exe
2260	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
1680	iexplore.exe
1680	iexplore.exe
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2928	1680	iexplore.exe	28
PID 1680 wrote to memory of 2928	1680	iexplore.exe	28
PID 1680 wrote to memory of 2928	1680	iexplore.exe	28
PID 1680 wrote to memory of 2928	1680	iexplore.exe	28
PID 2928 wrote to memory of 1008	2928	IEXPLORE.EXE	34
PID 2928 wrote to memory of 1008	2928	IEXPLORE.EXE	34
PID 2928 wrote to memory of 1008	2928	IEXPLORE.EXE	34
PID 2928 wrote to memory of 1008	2928	IEXPLORE.EXE	34
PID 1008 wrote to memory of 2260	1008	svchost.exe	35
PID 1008 wrote to memory of 2260	1008	svchost.exe	35
PID 1008 wrote to memory of 2260	1008	svchost.exe	35
PID 1008 wrote to memory of 2260	1008	svchost.exe	35
PID 2260 wrote to memory of 1536	2260	DesktopLayer.exe	36
PID 2260 wrote to memory of 1536	2260	DesktopLayer.exe	36
PID 2260 wrote to memory of 1536	2260	DesktopLayer.exe	36
PID 2260 wrote to memory of 1536	2260	DesktopLayer.exe	36
PID 1680 wrote to memory of 1544	1680	iexplore.exe	37
PID 1680 wrote to memory of 1544	1680	iexplore.exe	37
PID 1680 wrote to memory of 1544	1680	iexplore.exe	37
PID 1680 wrote to memory of 1544	1680	iexplore.exe	37

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21dbca0cbb0de0d7492ca39593a2940d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:537606 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1544

Network

DNS

www.oeob3u.top

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.oeob3u.top

IN A

Response
DNS

news.share.baidu.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

news.share.baidu.com

IN A

Response

news.share.baidu.com

IN CNAME

news.share.n.shifen.com

news.share.n.shifen.com

IN A

182.61.244.229

news.share.n.shifen.com

IN A

39.156.68.163

news.share.n.shifen.com

IN A

112.34.113.148

news.share.n.shifen.com

IN A

180.101.212.103

news.share.n.shifen.com

IN A

182.61.201.93

news.share.n.shifen.com

IN A

182.61.201.94
DNS

api.bing.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

api.bing.com

IN A

Response

api.bing.com

IN CNAME

api-bing-com.e-0001.e-msedge.net

api-bing-com.e-0001.e-msedge.net

IN CNAME

e-0001.e-msedge.net

e-0001.e-msedge.net

IN A

13.107.5.80

182.61.244.229:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
182.61.244.229:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
39.156.68.163:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
39.156.68.163:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
112.34.113.148:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
112.34.113.148:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.7kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.6kB
9
12
180.101.212.103:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
180.101.212.103:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
182.61.201.93:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3
182.61.201.93:80

news.share.baidu.com

IEXPLORE.EXE

152 B
3

8.8.8.8:53

www.oeob3u.top

dns

IEXPLORE.EXE

60 B
130 B
1
1

DNS Request

www.oeob3u.top
8.8.8.8:53

news.share.baidu.com

dns

IEXPLORE.EXE

66 B
196 B
1
1

DNS Request

news.share.baidu.com

DNS Response

182.61.244.229

39.156.68.163

112.34.113.148

180.101.212.103

182.61.201.93

182.61.201.94
8.8.8.8:53

api.bing.com

dns

iexplore.exe

58 B
134 B
1
1

DNS Request

api.bing.com

DNS Response

13.107.5.80

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eb0d0d5ff99aaa193095b5c717bf995

SHA1
3a64605e6a2ff0c81100240ec3d43932e9bdbe33

SHA256
d89e1066032067b67e6378918dbea7990ced392dcd1f955bdbe123a3dbc4208a

SHA512
162c5ca4d8c3f00eba864dddfc0dca59c07ab2c4daab484952decd05b96928490b1843cf131be3e49cdb216a68108fc7d04c866f632a0534f005792e87b83783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6830034257d65e74779c3baab43ac582

SHA1
572608b9862560e523926b231d4d5400708fcfb2

SHA256
18e41c83ed36003b205c07ac04118018e4cab5117ca49c89813f97d85f5c2c19

SHA512
754db2d94ab0b792fbb505c5f55bd1c3d6823efc446016a91ce78d3a9bbfd534b76d81c7362852ab1b30014814ed0af960135c590f96c495eb6c4343e1f1fccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
336ae41e4c7a08af290bcc37e0aeec11

SHA1
ae77550688c62db50bb58aa6cd6aab5ec51cfc65

SHA256
ccff5db98e235b607f938acf3573d68e2c5bc9e40822b333c7cf9a4e88cb0961

SHA512
094975c5d7787db70df9b2231f9581ec3d3cffc5a32e5b9ac362cb6832ab488ccf439ae99ed3da2e2ec68bd4aebb1b82404f08806fdfe7c711ebf907f917c7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20c63f6dc2022cb540b25c0a60326f10

SHA1
6a33c295d0b687080fe45828a9fa911750adba0e

SHA256
a2f37b2d44693e311ca9bc5a0033f6396a39b7df6f987cc58926d2690dbe8a25

SHA512
31f6a2724b4f99810cf98fcf1bdb6812a1a209528e3233e0854f24fada55763a0551a90808a9b14fdc515025a3726c682a8232f6fb905c01c043717f2333f05e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec15305dc04c4dfa45d73c13206635d3

SHA1
1e1ab2976bb90f48834e80cd1d25df0b7aebeda7

SHA256
98e127b2d956862d8d77dd22a042c615c6b95b6245b9d8ad776104057d6ec366

SHA512
95adf052f00b62e37ba9297c91ab01468f4d85271e85d4bc010c31a3631b7993a03034c55c8bc24a76486a435b78e458f5ea10a421693f4437578cdb447f5213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c65c00dfe8ac97a6951b494a4d1ce368

SHA1
34159740d8de2069c237e0be39e5d1738a3444e6

SHA256
ef641c7a2ae152e593f47959ce4e84a960aae6041cd3d690dcfab3430aa72090

SHA512
03d178b4a7e09907847150e528a39d696ed242fddcad7f7e3655c4d4faed68d55113c5290efce1a0fb53c341f69cfc4ec41e75fb2dc2f5b04aa400124592e9b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31e71b2108f99f1cacd393ed04df9057

SHA1
0b6bc74f35b7fd02894a1183b5fffcad667625f6

SHA256
26d8467072afa2e27f942d035f2e91cd0385ae4ac16e96760743574218f04a03

SHA512
97468fa6bf4d074c0b429a0d053667833ad7814abef5aa43d5aeb5f2848d38e30456acb348b6ddf4bd5fbb2d4f042b9bf1b0ffdd5834c8eadca3f8b4d7607a1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3625aa6fac1860ac3adba198338f8f8b

SHA1
f6d88c33aa03c50e9e790f162d70d20717c47cc8

SHA256
e54d6e2f2858df31fb7a17675392821881b2c8d458053ddd286fa30c00b9ea0d

SHA512
b200d6ade4e188b4a0b3652ad1b7bb6565a99482330556a29cc053347b40f4cbdb6a758624c930cc68403a47c3d12901635ca2340140c43571661a9474299675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25cfac1b68fce98692551e9dfd96bed6

SHA1
8c9c8d1b322b05f35d1b4b09fe23d76770c4998f

SHA256
e9046ab3283cf246a7b8cc55d999a3517f340b6e090a55dfcb0cff2e762d7bf5

SHA512
7d56b025c818eb67325e976ed2d448f8c2962c14cfe8791d9ff5440fdc337357b1c1229c2a53f81cae126e1d24c062c7d7df7a2936ed2e14e09569a48a35fa83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e45806e171f3a439ea492cfdaabd57d0

SHA1
15258d0514a25266448afafedb5834c4ef5dc64c

SHA256
0179d585e5b1e26b3131b5aa79fd1ab33008f96547d35e9064384623c00aec1c

SHA512
7598fe55329ba2c0fde5b3c5457f31339a82e6e3812f04d0b4fccac29736d485bcc532461cb3b7dc7b66afe1de7586dc868c9b1e9fd4d08a92c0c6fc03276664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2851ea73dd0a7407542bff5e9cfe7bda

SHA1
a8d4344f68d31006e19f7de908d950fc6739b13c

SHA256
8133561b92388f6c904ad17254ff13db860ae7dcf8435b0ca7206e691c7909c9

SHA512
f2e57e0d6ef10abae19cf5f08adc52242ceacb7c9a21e6d2440c2979d25e0cca3b17aeb8b9453d8ce0e2188811eeacd6902183fbc1e48cc64d41c2ae6cd71e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5c239a1a5b7d50e2e68c53be3d6a6ca

SHA1
db821a2bef727b95a1cc97f62274054a44a3b30c

SHA256
5d84753b3ab8fdf339e1c81a7023786a90625f21c6c50da7365a75997b534b2b

SHA512
e650c69aab8453eb5ca6aedb6246daa69cbd135de0691930d43f2a50fd0e75de71f514ed722cff213912f9dc5a05ba757d21bfa3e180b6bb2ce8ec05475fc0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ec3ba2d2764d911536fca4a2cf60e52

SHA1
4beaa143b8bb784d3e3810a8c22fa4ce57754237

SHA256
90d16c8a8104c0ba426dcd216341cfb78d041ec8f170c7cf4c71a224112e7b61

SHA512
4cbb62b182dc387a1ee37d3ed75af6bc1ebcc52ce258c0f9ec25b8ce01156547674d4b10e0d3460b0b4f75f6d969e04933495569ef1ee7c97be86b71a6c056a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54fa6f0faf5758f0926cee417784f485

SHA1
caf159254035ef9933b249ac278ed73d958dcfe2

SHA256
f301cef2f9db350721835705b1426ccb3b777357b80ffb658534aa370b08fc98

SHA512
e542996acd6ed6270219cc1ba35c78245588286142e7702b3601125199d5a7978ca3a17ce37e2e11d7ba51fdf9c960be59008244274d6663d83e2c59f89ba649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cef00f2d70c5dbab4d81dc07afe7f895

SHA1
3f6afb351a0aae5cb4c47db916a3253391f5f0c5

SHA256
581d47ec520b1e508fc2119c9fdddc53e9acd4207c3aab71e70625de7b986164

SHA512
012f0d140b6b88f0aeb009c97e97118eb1767f929e8548e94771986f7f814852ba7225f7c92ee84b5d4d8f5c5c9a00285c582b52d2f4ad5008c1e6780026f700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3052055ea79c16f4e8e0e3e35b71f14d

SHA1
39467843449b553e02697011c04d7a5167ba863d

SHA256
241f3ec5c51a4c83759f7894d538a8f74aacdd7f47184a1913741f6452f4acf7

SHA512
8c9f1846a8ddb4453e45ec3bbe6e1542e369dc1b3c71886fe2a2d23b3a5bf1c0ea95e7474fa451257ffde6b031b3d942b35b35b39ee46b631a008fe5f668d062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea1677c9fe16a5421f8023a37b09e5c7

SHA1
bfdf0c6e237018f89b7e09e44146c6c154623c9f

SHA256
f9de61929651fd695962b95018760981db55fe1fd68e444558f309bdc0876933

SHA512
bc96641474edbbf891cf5736e8dfe218d3c0472e71c6bc5d49557d959e4fdbaed6ef3762bf292be3be3518c81a12e34ad9539c8f13e4c3c3e813790ce1823af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67f7040cd86b247d7c44722dde4cf4ec

SHA1
1ddebab34d428d2abae235459d1a8f151ec2fc37

SHA256
1960bf0e61e6b4dd90ecced89b643671db8163611e3849dad7164c1ddc291ba4

SHA512
ac32a57203e6c92d6477d93d9b5e78f9b3e64a1bf4ffb4d0a2fb2b44e2e20f419d50bbc46b7810903fe50c8977cc0b1b83d8b020d83a7fb50f7f02587382dae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
822f97ecdb14ef621d36b9c5a6ae9db6

SHA1
dde9f9ad0c92774fa082173536d243a8be8ce5de

SHA256
cb86dae3981c10da3bc31a4044dd39cf65378fb966b7a8bc5c1fb68e6be1c8de

SHA512
0a108a1562b5f06b603825c78913914c3f808cb5f205a23c7cecdaccd116a8e100af8af1fffb743de2ca3c6fa722be5b0e92d36f2397ae04ac15d1673f73783e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD54.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE26.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1008-482-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1008-483-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2260-490-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2260-491-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2260-493-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2260-492-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.