ramnit | 4c9ca3fae841ecc25c382181246d030dff917119015ded84411dcd6e2f88b021

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8303f360f507f1586ad97af254272f7b_JaffaCakes118.html
Size

347KB
MD5

8303f360f507f1586ad97af254272f7b
SHA1

08a3dfc15e69f2c8a93f046b5f4936c5c2ac1a58
SHA256

4c9ca3fae841ecc25c382181246d030dff917119015ded84411dcd6e2f88b021
SHA512

88437a6fd869103a111510707a03bc2aa9df779f2e106809aad82dc1080e649ba408e72f2dfe45247c3a2799e74d93cc7ebfbdbfb752a30cd659ed8d2f5ecf91
SSDEEP

6144:8sMYod+X3oI+YcsMYod+X3oI+Y5sMYod+X3oI+YQ:q5d+X3w5d+X3f5d+X3+

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 6 IoCs

Processes:

svchost.exeDesktopLayer.exesvchost.exeDesktopLayer.exesvchost.exeDesktopLayer.exe

pid process

2664 svchost.exe
2556 DesktopLayer.exe
2512 svchost.exe
1048 DesktopLayer.exe
808 svchost.exe
1932 DesktopLayer.exe
Loads dropped DLL 4 IoCs

Processes:

IEXPLORE.EXEsvchost.exe

pid process

1188 IEXPLORE.EXE
2664 svchost.exe
1188 IEXPLORE.EXE
1188 IEXPLORE.EXE

pid	process
2664	svchost.exe
2556	DesktopLayer.exe
2512	svchost.exe
1048	DesktopLayer.exe
808	svchost.exe
1932	DesktopLayer.exe

pid	process
1188	IEXPLORE.EXE
2664	svchost.exe
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\svchost.exe	upx
behavioral1/memory/2664-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2664-9-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2556-19-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1048-27-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1048-30-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/808-33-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 7 IoCs

Processes:

svchost.exesvchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px257B.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px2433.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px253C.tmp	svchost.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e48b41759c8e2c478e419c237bd7a28400000000020000000000106600000001000020000000ae71773c2c3a6f1396948cc7839276835452fc8c17b0beebd686a4c80d77d1a0000000000e80000000020000200000001713b4dbb5b9a8e009a9888c2b0fe0f394fd7851bdae636433271c35df34eaeb2000000001ba2bc41f8eba85d51f3ab6382ee5c31026362d42c02bab9ffa1ccc5a8c879140000000fd44fa910d31c38d8628882a9e9686d7515c03b4721826d009b5bcc5472b90362abe160b26ee1789c2c9299ae8004143668c75e2f5868ad5f0d889776cffda97	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{575545E1-1E3C-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a3113049b2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e48b41759c8e2c478e419c237bd7a28400000000020000000000106600000001000020000000e40335a9a00e2b6332976e11774f2a30da397ca36da08ba631d7720c73269042000000000e80000000020000200000008b01a633b5348fbc2820b801bde7ab03b52ce71a667628f12f0d90cd351ef2d09000000076aeabb374e7c99448e24831df5b15ae98fe2484dc8e4bba87d608e0c09288c78e108c9a87034fa784996d456b9b101a58539bd9215d9914ba4d2a7da16e2fa48733c97711dc761be9818c3b5f80e3d09d60d9e1c84d635d19d32471ce5acde9fb3d2ab6138dd80af99e72bd830f139c3ce3a1f08e2dbc688cd5c55ac8f7ac128148b5cabb967191b8da664ef51c52564000000086c905d7c1eb4e34715321f9fe278fa304e0d9020ce74003316b25812afb457a99c5cb8ae321df92457715788465e7c05a755b1f65453a8dc984a210ac8fb53d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423204866"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

DesktopLayer.exeDesktopLayer.exeDesktopLayer.exe

pid	process
2556	DesktopLayer.exe
2556	DesktopLayer.exe
2556	DesktopLayer.exe
2556	DesktopLayer.exe
1048	DesktopLayer.exe
1048	DesktopLayer.exe
1048	DesktopLayer.exe
1048	DesktopLayer.exe
1932	DesktopLayer.exe
1932	DesktopLayer.exe
1932	DesktopLayer.exe
1932	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exe

pid process

2844 iexplore.exe
2844 iexplore.exe
2844 iexplore.exe
2844 iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
2844	iexplore.exe
2844	iexplore.exe
1188	IEXPLORE.EXE
1188	IEXPLORE.EXE
2844	iexplore.exe
2844	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2844	iexplore.exe
2844	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2844	iexplore.exe
2844	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsvchost.exeDesktopLayer.exesvchost.exeDesktopLayer.exesvchost.exeDesktopLayer.exe

description	pid	process	target process
PID 2844 wrote to memory of 1188	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 1188	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 1188	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 1188	2844	iexplore.exe	IEXPLORE.EXE
PID 1188 wrote to memory of 2664	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 2664	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 2664	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 2664	1188	IEXPLORE.EXE	svchost.exe
PID 2664 wrote to memory of 2556	2664	svchost.exe	DesktopLayer.exe
PID 2664 wrote to memory of 2556	2664	svchost.exe	DesktopLayer.exe
PID 2664 wrote to memory of 2556	2664	svchost.exe	DesktopLayer.exe
PID 2664 wrote to memory of 2556	2664	svchost.exe	DesktopLayer.exe
PID 2556 wrote to memory of 2748	2556	DesktopLayer.exe	iexplore.exe
PID 2556 wrote to memory of 2748	2556	DesktopLayer.exe	iexplore.exe
PID 2556 wrote to memory of 2748	2556	DesktopLayer.exe	iexplore.exe
PID 2556 wrote to memory of 2748	2556	DesktopLayer.exe	iexplore.exe
PID 2844 wrote to memory of 2464	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2464	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2464	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2464	2844	iexplore.exe	IEXPLORE.EXE
PID 1188 wrote to memory of 2512	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 2512	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 2512	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 2512	1188	IEXPLORE.EXE	svchost.exe
PID 2512 wrote to memory of 1048	2512	svchost.exe	DesktopLayer.exe
PID 2512 wrote to memory of 1048	2512	svchost.exe	DesktopLayer.exe
PID 2512 wrote to memory of 1048	2512	svchost.exe	DesktopLayer.exe
PID 2512 wrote to memory of 1048	2512	svchost.exe	DesktopLayer.exe
PID 1188 wrote to memory of 808	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 808	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 808	1188	IEXPLORE.EXE	svchost.exe
PID 1188 wrote to memory of 808	1188	IEXPLORE.EXE	svchost.exe
PID 1048 wrote to memory of 2928	1048	DesktopLayer.exe	iexplore.exe
PID 1048 wrote to memory of 2928	1048	DesktopLayer.exe	iexplore.exe
PID 1048 wrote to memory of 2928	1048	DesktopLayer.exe	iexplore.exe
PID 1048 wrote to memory of 2928	1048	DesktopLayer.exe	iexplore.exe
PID 2844 wrote to memory of 2476	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2476	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2476	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 2476	2844	iexplore.exe	IEXPLORE.EXE
PID 808 wrote to memory of 1932	808	svchost.exe	DesktopLayer.exe
PID 808 wrote to memory of 1932	808	svchost.exe	DesktopLayer.exe
PID 808 wrote to memory of 1932	808	svchost.exe	DesktopLayer.exe
PID 808 wrote to memory of 1932	808	svchost.exe	DesktopLayer.exe
PID 1932 wrote to memory of 2780	1932	DesktopLayer.exe	iexplore.exe
PID 1932 wrote to memory of 2780	1932	DesktopLayer.exe	iexplore.exe
PID 1932 wrote to memory of 2780	1932	DesktopLayer.exe	iexplore.exe
PID 1932 wrote to memory of 2780	1932	DesktopLayer.exe	iexplore.exe
PID 2844 wrote to memory of 1800	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 1800	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 1800	2844	iexplore.exe	IEXPLORE.EXE
PID 2844 wrote to memory of 1800	2844	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8303f360f507f1586ad97af254272f7b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2748
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1048
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2928
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275465 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:734215 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:799755 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0cb1e0b599144a0526ca871b5e4ff26

SHA1
9ffddefe4d487027f5243fcf6fe3d9453663d0bd

SHA256
4855ba14d6157982ffbfc96cccb9f76e7e2928070e8c24d99381b16307b77508

SHA512
3af5f824ba20cae3d208041ac9db88d8f793d124de1a313fff15577fd3f9c1ac41607e1d18116f3f544682b7761e80d65bb0c8f242dff28d66e294edca46b2b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11c3f980188d072086475513dedfb351

SHA1
cfa9a2373d50f30aff2d56cd57fbbd2afafb5a82

SHA256
ebf6654472b9675fa94e7b1716e28173210590e05a9eae236f23e99a093cb9cc

SHA512
d0f7cfbd39057bc466d42cd000cc32fe2391c22f479c8add6f61f6f122292f73e099681532ecd6857cfa1f9e397c89c4f4e59222ebdc745c8ee560326f19475e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
417a2f7bb289ed6ffd394f8c740d09dc

SHA1
0a31cc3f7b181e6315c7c49852c3170d11bc49ae

SHA256
934b11122bab92db2925419bad0a568b866b91f314a6b84121a855fb06ffd6b2

SHA512
0f9b5d3822d6e1e6247b6353e5e78626097681fd74c4b26c62e130adbeacd78254624e831ce56f3045ecbe8342367c119e75702e359d719335a69cda230b12e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b00733ab69a0252795e702cc9a2b846

SHA1
255c18ca1d3c95125424fbe6a8b25901fe142601

SHA256
5e4d3e361058618b07ff7552a7e4e2ac0532c40123cc698894956aed50eac8d3

SHA512
a47d6a6a3d4ce14bd24d855796126f80e74b461f98cfc043d5c7c11c5bc431845b50f9bcda181c7bb16b337d94779bc1f4ea21a7c0f2e94da3c372eacf6ef733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a99a373dab328f938ad6696643542dd

SHA1
3d1410b08c69f1303251c471be6faca94d1358a9

SHA256
860d0ef9d8d995cfb9a2805f68db3dc3da4035cf73cf96323ec5aff9254fcad5

SHA512
94344bd6b506ee827bcb64fe4521ed151f2a803616bdf0934aff4aa76c6ee5ffba8f022df08cf6dd3b39523e1f2cf828c920684df294b9fe0b80d392e369831d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21a2f2cffc74b3aafc9406cc5e77d6a2

SHA1
ee9d1f5717ea0f6693108f956fff78323d071bf4

SHA256
61f06f17da71b789b34379b6152c164dc314c0b4a00a8b6f7a8203046b9d5170

SHA512
e5b8a6acb96576166bf6bc359f7d73c3c9e107b3e8cd9edf50da3742f11c31076e4362b0031ba0de825429a10bdcfcbe5e2bffce5fade481b4db3b03d84328d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2139.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar222B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
memory/808-33-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1048-30-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1048-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2556-19-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2556-17-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2664-8-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2664-9-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2664-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download