ramnit | c8ca823e60d2d8bbea30b8577fc65cc26136b4c9552148d360f5a050ae27fdd3

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8063625d3762ac616ba517b0fd724e42_JaffaCakes118.html
Size

698KB
MD5

8063625d3762ac616ba517b0fd724e42
SHA1

d0ad8600a81cc69693fa49aab8abf194c6bd2fba
SHA256

c8ca823e60d2d8bbea30b8577fc65cc26136b4c9552148d360f5a050ae27fdd3
SHA512

abd2140a7c1950d3000b2c2ea1b53fa1afde603a6ea5461feeec58c9a3c81602d1a1dba40cad4823390efc730ba0650f3801e0c8902856e0c1ea2bf3eaf13dff
SSDEEP

12288:w5d+X3kCdlDG5d+X3kCdlDN5d+X3YCdlDC:K+ECdm+ECdX+4Cdk

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 10 IoCs

Processes:

svchost.exesvchost.exesvchostSrv.exeDesktopLayer.exeDesktopLayerSrv.exesvchost.exesvchostSrv.exeDesktopLayer.exeDesktopLayerSrv.exeDesktopLayer.exe

pid	process
2480	svchost.exe
2596	svchost.exe
2388	svchostSrv.exe
2580	DesktopLayer.exe
2320	DesktopLayerSrv.exe
1696	svchost.exe
760	svchostSrv.exe
2848	DesktopLayer.exe
1660	DesktopLayerSrv.exe
1672	DesktopLayer.exe

Loads dropped DLL 9 IoCs

Processes:

IEXPLORE.EXEsvchost.exeDesktopLayer.exesvchost.exeDesktopLayer.exeDesktopLayerSrv.exe

pid	process
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2596	svchost.exe
2596	svchost.exe
2580	DesktopLayer.exe
2024	IEXPLORE.EXE
1696	svchost.exe
2848	DesktopLayer.exe
1660	DesktopLayerSrv.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\svchost.exe	upx
behavioral1/memory/2480-12-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2596-15-0x0000000000400000-0x000000000043D000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx
behavioral1/memory/2388-46-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2596-20-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2580-41-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2480-36-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2388-42-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2320-50-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2580-31-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2480-30-0x0000000000400000-0x000000000043D000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/760-537-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1660-555-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1672-559-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1672-561-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 17 IoCs

Processes:

svchost.exesvchostSrv.exeDesktopLayerSrv.exesvchostSrv.exesvchost.exeDesktopLayer.exeDesktopLayerSrv.exeDesktopLayer.exesvchost.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px18ED.tmp	svchostSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px190C.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchostSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5CC0.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchostSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5CB1.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px5CB1.tmp	svchostSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px18BE.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px18CE.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35060621-1DA4-11EF-AAE3-FED1941498E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423139525"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

svchost.exeDesktopLayer.exesvchostSrv.exeDesktopLayerSrv.exesvchostSrv.exeDesktopLayer.exeDesktopLayer.exe

pid	process
2480	svchost.exe
2480	svchost.exe
2480	svchost.exe
2480	svchost.exe
2580	DesktopLayer.exe
2580	DesktopLayer.exe
2580	DesktopLayer.exe
2580	DesktopLayer.exe
2388	svchostSrv.exe
2388	svchostSrv.exe
2388	svchostSrv.exe
2388	svchostSrv.exe
2320	DesktopLayerSrv.exe
2320	DesktopLayerSrv.exe
2320	DesktopLayerSrv.exe
2320	DesktopLayerSrv.exe
760	svchostSrv.exe
760	svchostSrv.exe
760	svchostSrv.exe
2848	DesktopLayer.exe
2848	DesktopLayer.exe
760	svchostSrv.exe
2848	DesktopLayer.exe
2848	DesktopLayer.exe
1672	DesktopLayer.exe
1672	DesktopLayer.exe
1672	DesktopLayer.exe
1672	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

iexplore.exe

pid process

2108 iexplore.exe
2108 iexplore.exe
2108 iexplore.exe
2108 iexplore.exe
2108 iexplore.exe
2108 iexplore.exe
2108 iexplore.exe
2108 iexplore.exe

Suspicious use of SetWindowsHookEx 34 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
2108	iexplore.exe
2108	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
1592	IEXPLORE.EXE
1592	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2108	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsvchost.exesvchost.exeDesktopLayer.exesvchostSrv.exeDesktopLayerSrv.exesvchost.exe

description	pid	process	target process
PID 2108 wrote to memory of 2024	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2024	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2024	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2024	2108	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 2480	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 2480	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 2480	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 2480	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 2596	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 2596	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 2596	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 2596	2024	IEXPLORE.EXE	svchost.exe
PID 2596 wrote to memory of 2388	2596	svchost.exe	svchostSrv.exe
PID 2596 wrote to memory of 2388	2596	svchost.exe	svchostSrv.exe
PID 2596 wrote to memory of 2388	2596	svchost.exe	svchostSrv.exe
PID 2596 wrote to memory of 2388	2596	svchost.exe	svchostSrv.exe
PID 2596 wrote to memory of 2580	2596	svchost.exe	DesktopLayer.exe
PID 2596 wrote to memory of 2580	2596	svchost.exe	DesktopLayer.exe
PID 2596 wrote to memory of 2580	2596	svchost.exe	DesktopLayer.exe
PID 2596 wrote to memory of 2580	2596	svchost.exe	DesktopLayer.exe
PID 2480 wrote to memory of 2396	2480	svchost.exe	iexplore.exe
PID 2480 wrote to memory of 2396	2480	svchost.exe	iexplore.exe
PID 2480 wrote to memory of 2396	2480	svchost.exe	iexplore.exe
PID 2480 wrote to memory of 2396	2480	svchost.exe	iexplore.exe
PID 2580 wrote to memory of 2320	2580	DesktopLayer.exe	DesktopLayerSrv.exe
PID 2580 wrote to memory of 2320	2580	DesktopLayer.exe	DesktopLayerSrv.exe
PID 2580 wrote to memory of 2320	2580	DesktopLayer.exe	DesktopLayerSrv.exe
PID 2580 wrote to memory of 2320	2580	DesktopLayer.exe	DesktopLayerSrv.exe
PID 2580 wrote to memory of 2088	2580	DesktopLayer.exe	iexplore.exe
PID 2580 wrote to memory of 2088	2580	DesktopLayer.exe	iexplore.exe
PID 2580 wrote to memory of 2088	2580	DesktopLayer.exe	iexplore.exe
PID 2580 wrote to memory of 2088	2580	DesktopLayer.exe	iexplore.exe
PID 2388 wrote to memory of 1636	2388	svchostSrv.exe	iexplore.exe
PID 2388 wrote to memory of 1636	2388	svchostSrv.exe	iexplore.exe
PID 2388 wrote to memory of 1636	2388	svchostSrv.exe	iexplore.exe
PID 2388 wrote to memory of 1636	2388	svchostSrv.exe	iexplore.exe
PID 2320 wrote to memory of 2452	2320	DesktopLayerSrv.exe	iexplore.exe
PID 2320 wrote to memory of 2452	2320	DesktopLayerSrv.exe	iexplore.exe
PID 2320 wrote to memory of 2452	2320	DesktopLayerSrv.exe	iexplore.exe
PID 2320 wrote to memory of 2452	2320	DesktopLayerSrv.exe	iexplore.exe
PID 2108 wrote to memory of 2748	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2748	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2748	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 2748	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1592	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1592	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1592	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1592	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1564	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1564	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1564	2108	iexplore.exe	IEXPLORE.EXE
PID 2108 wrote to memory of 1564	2108	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1696	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 1696	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 1696	2024	IEXPLORE.EXE	svchost.exe
PID 2024 wrote to memory of 1696	2024	IEXPLORE.EXE	svchost.exe
PID 1696 wrote to memory of 760	1696	svchost.exe	svchostSrv.exe
PID 1696 wrote to memory of 760	1696	svchost.exe	svchostSrv.exe
PID 1696 wrote to memory of 760	1696	svchost.exe	svchostSrv.exe
PID 1696 wrote to memory of 760	1696	svchost.exe	svchostSrv.exe
PID 1696 wrote to memory of 2848	1696	svchost.exe	DesktopLayer.exe
PID 1696 wrote to memory of 2848	1696	svchost.exe	DesktopLayer.exe
PID 1696 wrote to memory of 2848	1696	svchost.exe	DesktopLayer.exe
PID 1696 wrote to memory of 2848	1696	svchost.exe	DesktopLayer.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8063625d3762ac616ba517b0fd724e42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2396
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
      C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1636
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2320
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:2452
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2088
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
      C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:760
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2860
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:2848
    - - C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:1660
      - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1672
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2288
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:668677 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:603140 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1592
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:930819 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:2044945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:1651721 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
64KB

MD5
c2894448d11d790e9b600a564e770139

SHA1
02b582a3d61aa0fd6db6841371308cdb77428e71

SHA256
70089eb916dd9dad24b3289515473d82b9fc5d76c8c954adcc363853dc62e837

SHA512
231c24d7305be36bc4862459550f09d5125fa2092f37e703cdddb6f6f8731797fd4b2e7357149baa7bfca8623d2e99f9f037733ce13cefd3bd38465999f953ba

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4541c30efa6805654fb0475661c292e3

SHA1
9824ed36bd9bc22acd720d0205b5dee673a1bb05

SHA256
5bd0cb7691b22d554035419302283250fd9ec5fecd442de169b611586e4dc445

SHA512
64a18207a52b7ea969d8687bebb65a3d9b7e38738743f173dd93db64cdecfe5543e15aabdfbd1a1b86c2254ab3d62b9c97d4f8dfe75662309a00204e09135954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b6a1e81e751676cf0f5b4a609887ec3

SHA1
3f9f4b54637db037e789de1668dc7bf317bbe4d2

SHA256
27abf983d1b82e15f97c353f72d1fe404b2714ac0cdd8dc4e84052b26da3b668

SHA512
e475025cb5fd949d4d0ca7506964101a81791a155d92c3e73d2b63527a52cde4203f3ac9560065fbb723cd346c849ab01e98d493a6dcce42996bb94977470f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a901388a965389ec8853ec1b91c30f

SHA1
29265e8ee668175b2619dab6ef85fe051c282de9

SHA256
b4dd275fdc103c25a3b7c824f1696fb5d68f124dc71b413c77b55e8b79da2ff3

SHA512
74c0e49eb54217fc48b45fa7d495b2c7f82ebb698e19d1566a7e3f4c7f8a23cd0e74ef4f3efb89ff4c546abdb8ade46f9a164da5f30202a29946db9dc8d7dc09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
517352ac6e078c8ac2d117ceb44a7706

SHA1
a6b2ce6886ae2aacddedbda18107eab736d4a856

SHA256
95ba80db47a03fb042daacff08bc2cc7aca51afccb2efb817175fe93f089d260

SHA512
8be5023049a6265f058e241d35dd00fcfbb78b1b408916d3323ab89d7ff06da59b6c2edd6e56698042ffaa950b26934cd95239a0ef0f1bbe85710f3fe4694e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e194df2182746b97919c594246899b8

SHA1
f965bd212a9b8f4aa36e2bd6de3f21e7c2a537d4

SHA256
b6de56c9c514565ef3c42e1f2a8a48c746e1b208327a40a509c649f9b62e8952

SHA512
e701b6344887acfcf8c3ef5b8d680383437063a423f9bf1222acf02983d8f3c8e00a885a09a665848824db6932545b334063d09a57c95e94945372c1e4946776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1345c5c8298bca47d9efe542182ef19

SHA1
8490ffca3eb9909e4afbabe0691f125336890cd3

SHA256
39e05356e13d5890adc142ba9907aa93b72b699d26eff4770d52e53fbd2948e2

SHA512
865b769286405ced21fb5416855abb49e44b03222dd6281f978b2847ffbc9ad3d1f49b5c0f361c52510223f0343e7f37db9ab058611fa1c50ef270d12052bb55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
beb22e061ad3ab2c33ecbe254da02b7b

SHA1
467ead1178ecad28755e95a212912c1f1bfcf4ec

SHA256
fcdb4d1d3815401aae3695def47589c07ceed5594d8883f775622b5105209529

SHA512
888a182f8023b36e0090cd9f5390e9d07ecacc6149fae050b3eba82f9322e2187bfb2dbd1ab49ec00916da79c4129a057e603b64a9d7439fc618120f8b7ab902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3e5568acb4d3fa58e51bd1e8908d909

SHA1
50a158aa6898ebb9cdbf977e0fcb5ddf5622e0ca

SHA256
d55b8194bbbd4c8e642d32cd0d1fa9ab33bdcb8d3fea3b43e6eaf7c4635bf35a

SHA512
e50a688cc32ac0ce3d8b7cb6ba2ce52f55ac48248e3123cd12c7951bec0e58cdf6bd13589a598b0a28cd9b9e1bb880ab9639c841531e62c8a3eab27cba6ded78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bd78503f40ca70d1f6be630baee71fa

SHA1
51129420a9969e76637cebcf98e6ee286a97cee4

SHA256
5dc356e93502ab6006c2a6c7130e44d0e938a953d75910d66157ed5f540f6fc8

SHA512
43288b7be40404dc80ebffe8010e6c4bd4b85b58df3dacb2b544be36a6757682e4c699fa9df5cd153d8ceec63d02d7fe5c00ef6249e8e6395675ae03b26fdc54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14CA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1588.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar159C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
111KB

MD5
f9b6a36532ad339c536257d6d663ac50

SHA1
05bc904af61bd3dc99e431ce418ad3db8fbeaa96

SHA256
e359c2f9f18ff3d99b211670d64d29bf607d8a360b92866ce2e4bd7f3bd22a17

SHA512
8be67449f33a1fb18a1f11d171b0c33bff634f30778d67cea03641d8c0780dbcfcc9d59d68136696a89af0124710195f524d2753c49379d9a5e46418d2ae4f06

Download Submit
memory/760-537-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1660-555-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1672-559-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1672-561-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1696-535-0x00000000001C0000-0x00000000001EE000-memory.dmp

Filesize
184KB

Download
memory/2320-50-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2388-44-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2388-42-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2388-46-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2480-30-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-36-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2480-27-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2480-12-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2580-31-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2580-41-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2580-38-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2596-18-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2596-20-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2596-21-0x00000000002C0000-0x00000000002EE000-memory.dmp

Filesize
184KB

Download
memory/2596-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download