ramnit | 30faef67a778fc1d6ad92daee9f9d66ddf24650cd1cf98b3cf3846d0e1da0375

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c29fbde118ba243e7cfc750c77de61c0_JaffaCakes118.html
Size

704KB
MD5

c29fbde118ba243e7cfc750c77de61c0
SHA1

9a002542f1f5afe25da0e0f08b618a8f394f3f53
SHA256

30faef67a778fc1d6ad92daee9f9d66ddf24650cd1cf98b3cf3846d0e1da0375
SHA512

261a65d0059151654fb898d336a1c69d972701541e03e97cfba6e1466a83971c79e8a03f7ae31312b1756679de046b5090b3ae089185697b82b9d1e614480e3c
SSDEEP

12288:6D5d+X3vWPSmq5d+X3vWPSmte5d+X3vWPSmi5d+X3vWPSmq:6b+PWPE+PWPS+PWP0+PWPe

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
2648	svchost.exe
2216	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2356	IEXPLORE.EXE
2176	IEXPLORE.EXE

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000186f7-2.dat	upx
behavioral1/memory/2648-6-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2648-11-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2648-10-0x0000000000250000-0x000000000025F000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxBA0C.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBBD0.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430822701"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006a84d391f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE399C21-6384-11EF-BC8E-E6140BA5C80C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000195b529d4a5e37f277fc8a6029faf294788e1b64faaab249ee53fbf2636ce8c0000000000e8000000002000020000000d67b7058e0555da36bc63ceabbd5982ee34cff36e22ce69c436a8511f3f2ebaa200000009f5bc702f35494e5a3244185dc985901ace09da2226423580b1d90034921bc9e4000000086b13a8c9187bd32c81a645466e86f530d395723ece5be3c12c37fa8d0bd3a76779cbd2b98e51053338c5d0d9ed0dfeac75a3c856e731bdfed063e313a282544	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000e071420122dfe4120176f0f7561b268a707e830563e1f1d846593a3451f71042000000000e80000000020000200000005e063a0a76b8c2f3233350a8584a154d55892cc61e482044c41c043dc47b33ff9000000011c8c546cf71bfbfb6d782104fcc1e9b66476665909b241be767e1b8a73456a0e96522d7354c129842c04aecbc965cedfc6b9c58ecddd92a0c603342066643565ea7695bed849f978d1a671913bfea116bd3d0e8984b19727f629d68cb054b14d1af0bedc7d1026c12d093560289243c84c4a4bf8ef94c7432b7fcfcff23655a5ab02b1aa0f15a8e05367bd6041dc43840000000c7cc4c4313759b6ef78d72057b5c69b6e79e347aeae80205e09ea008a760e0ba991e657ef30612042eb7d17b7b2a06f52ef3e5615f60db7e4230ae898486880d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	svchost.exe
2216	svchost.exe

Suspicious behavior: MapViewOfSection 50 IoCs

pid	Process
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	svchost.exe
Token: SeDebugPrivilege	2216	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2356	2236	iexplore.exe	30
PID 2236 wrote to memory of 2356	2236	iexplore.exe	30
PID 2236 wrote to memory of 2356	2236	iexplore.exe	30
PID 2236 wrote to memory of 2356	2236	iexplore.exe	30
PID 2356 wrote to memory of 2648	2356	IEXPLORE.EXE	31
PID 2356 wrote to memory of 2648	2356	IEXPLORE.EXE	31
PID 2356 wrote to memory of 2648	2356	IEXPLORE.EXE	31
PID 2356 wrote to memory of 2648	2356	IEXPLORE.EXE	31
PID 2648 wrote to memory of 384	2648	svchost.exe	3
PID 2648 wrote to memory of 384	2648	svchost.exe	3
PID 2648 wrote to memory of 384	2648	svchost.exe	3
PID 2648 wrote to memory of 384	2648	svchost.exe	3
PID 2648 wrote to memory of 384	2648	svchost.exe	3
PID 2648 wrote to memory of 384	2648	svchost.exe	3
PID 2648 wrote to memory of 384	2648	svchost.exe	3
PID 2648 wrote to memory of 392	2648	svchost.exe	4
PID 2648 wrote to memory of 392	2648	svchost.exe	4
PID 2648 wrote to memory of 392	2648	svchost.exe	4
PID 2648 wrote to memory of 392	2648	svchost.exe	4
PID 2648 wrote to memory of 392	2648	svchost.exe	4
PID 2648 wrote to memory of 392	2648	svchost.exe	4
PID 2648 wrote to memory of 392	2648	svchost.exe	4
PID 2648 wrote to memory of 432	2648	svchost.exe	5
PID 2648 wrote to memory of 432	2648	svchost.exe	5
PID 2648 wrote to memory of 432	2648	svchost.exe	5
PID 2648 wrote to memory of 432	2648	svchost.exe	5
PID 2648 wrote to memory of 432	2648	svchost.exe	5
PID 2648 wrote to memory of 432	2648	svchost.exe	5
PID 2648 wrote to memory of 432	2648	svchost.exe	5
PID 2648 wrote to memory of 476	2648	svchost.exe	6
PID 2648 wrote to memory of 476	2648	svchost.exe	6
PID 2648 wrote to memory of 476	2648	svchost.exe	6
PID 2648 wrote to memory of 476	2648	svchost.exe	6
PID 2648 wrote to memory of 476	2648	svchost.exe	6
PID 2648 wrote to memory of 476	2648	svchost.exe	6
PID 2648 wrote to memory of 476	2648	svchost.exe	6
PID 2648 wrote to memory of 492	2648	svchost.exe	7
PID 2648 wrote to memory of 492	2648	svchost.exe	7
PID 2648 wrote to memory of 492	2648	svchost.exe	7
PID 2648 wrote to memory of 492	2648	svchost.exe	7
PID 2648 wrote to memory of 492	2648	svchost.exe	7
PID 2648 wrote to memory of 492	2648	svchost.exe	7
PID 2648 wrote to memory of 492	2648	svchost.exe	7
PID 2648 wrote to memory of 500	2648	svchost.exe	8
PID 2648 wrote to memory of 500	2648	svchost.exe	8
PID 2648 wrote to memory of 500	2648	svchost.exe	8
PID 2648 wrote to memory of 500	2648	svchost.exe	8
PID 2648 wrote to memory of 500	2648	svchost.exe	8
PID 2648 wrote to memory of 500	2648	svchost.exe	8
PID 2648 wrote to memory of 500	2648	svchost.exe	8
PID 2648 wrote to memory of 592	2648	svchost.exe	9
PID 2648 wrote to memory of 592	2648	svchost.exe	9
PID 2648 wrote to memory of 592	2648	svchost.exe	9
PID 2648 wrote to memory of 592	2648	svchost.exe	9
PID 2648 wrote to memory of 592	2648	svchost.exe	9
PID 2648 wrote to memory of 592	2648	svchost.exe	9
PID 2648 wrote to memory of 592	2648	svchost.exe	9
PID 2648 wrote to memory of 668	2648	svchost.exe	10
PID 2648 wrote to memory of 668	2648	svchost.exe	10
PID 2648 wrote to memory of 668	2648	svchost.exe	10
PID 2648 wrote to memory of 668	2648	svchost.exe	10
PID 2648 wrote to memory of 668	2648	svchost.exe	10
PID 2648 wrote to memory of 668	2648	svchost.exe	10
PID 2648 wrote to memory of 668	2648	svchost.exe	10

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1524
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1032
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:668
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1156
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:840
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:276
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1020
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1060
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1096
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:808
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2976
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2264
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c29fbde118ba243e7cfc750c77de61c0_JaffaCakes118.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2648
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:340994 /prefetch:2
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2216
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:209932 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f6e6185b3d57a4f75a4b76cbe8cc720

SHA1
2b99f66e59133ea7eac1863237b0626109faf0fe

SHA256
b174e0a3d62f606b05f3c6464a3d16369922ba201d51a829511e2a0bdb0a4795

SHA512
0c6c05fdc8fc33afa6bd744f06ac4f144aec63153de45728467b19a4b7bea7b0e72c0c7f74acc8d461676b52b33a50d237f49d3ac9a3135e53250856a4a423f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d40b3b69547de30b2be5c0d1c08a831b

SHA1
a27f7627b54258cd88c61f25c44c6d779af77f27

SHA256
d5d1a7930607e35e61c314c280b6918e3ed85076e36839b960bf9363031904cb

SHA512
7bad94c992d03b2490d6fc1f3b68a8464948b6c001d4e4736a662af46cd5bb64651272f00cc2505c34627447e02605cdd0f30e571ff23f02714736dd8951d71c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc842f63334ad09d1e53931c0c4f2a28

SHA1
4bf643569f8504ff551abafd8f73e6bd161cc122

SHA256
6b5f921ed2bd11d567e854fdbe0de2ef4871f240cf389373b790602c9398249c

SHA512
4b2d3fb3fda0e098aee4b44f426d75c158fe0827a604b5c731183daea2ab127a89fc94f678f7859ad45843744cb0cdefd1ae127b9855f22bfd31aa0bc0aa95db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be69f36a33148220a4d1e261b571a6d8

SHA1
8bbed86e831555bef96d9962bade41fcf6270904

SHA256
4d710ebb51ea9c6a48dac743de125c7fe38bdbc0fe2a645ca4fcc86405832f25

SHA512
e2ef68051dfeeea3601b4c63235cfb233653b376922033762c4863c02355edaa7b564b2a592049ad68cf946fb9c02b21db2d3067e359462863d29f37aa363729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96bcc0e829a8aeb250fb74ad99046bbb

SHA1
62454e531f97ad245af3d9075c0703202300e41d

SHA256
dd25ff164f3609ce3979c070672f01193290bab83a98e3ca8381202409b664a8

SHA512
1e19c9651f144181c257ba102cfe3550c02dfc3f11d867cadcf2b1ae36e5cac4be0618147216e16738a332dcf9d192f7c821371c56acb618c286599c809d7c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0b6ad60dc777513662d7892a1b8b84b

SHA1
ea5409feb169dbbae99c15d5dc9f10917f68d8cd

SHA256
a7d337c300753fe4315f5d980853c6358bc93ae8ff5d04d6898fb8a3343df5c9

SHA512
a68e8ded790b1ce23ea68fa506a4685eb1e07d9db3ef48bcb0e2e8dab26cb41de27c0d4577b22f17da21be400db72b0bd420819a17802079c4bb73001be4fbf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
386fde70abdbe440cf57748e68ea8078

SHA1
353d2c27d2bdf0dfaf61b6ba184945280b7165e1

SHA256
afb52fd1950096cf0157f34d138440a17e39c6fb58741100bbb1d79550858a53

SHA512
d9c8b4842c1ea8933dfb0e267efa6f39f12cb09056a5e4eb1b474442a0ce1d94444084ffa884fb8bb80d991da42f98d369e45709c88712e4af3eb5477b73df17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fefdd29d66a2c236e704d4c4b4d96fdb

SHA1
844aaa409403a9e3be4309bedf292eef609aa0ff

SHA256
bc3547d75da459209adbd4a55a91f2760b5f9275c09beebd97c577b58c1426fa

SHA512
45b583793985651b3b5413b25805bc7a52465c0d2345995e5608ab100d689069dd53b10c451404015fa298a6f2d421a55d5c0114c3dcc0038043f62f6c6e5213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae9d2b410053fd2e0847868c71572922

SHA1
7fcda10ab8f2d65ab191dc58c3d3253e8a7e23fd

SHA256
8b185a32c0bbca4d1b7d60add48197c6131bb50f540b64adbe93433b2545bdb5

SHA512
43aac6463ea71a1557b20f1341ddd6d8e2d7af046fb913b563a6f23f6519f9dfc33a948c99aeb2b988be2bcb6ab29db6f3f252f50db3bd713e5ec3d06450f722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dee0b9afbfdb1b7e2068112bd9b169c

SHA1
b73c9d348bd74c2f43cf1a6f3845bb90e7101ef6

SHA256
bf3e08301983fda78773aad5866a38da9f14f22cb1d2785bd3f6432680ca48ec

SHA512
1ca6bd80fa3a4889b10c0e2f2f421f17b9e4a542f2ecb6a22254a3dca4834ddee5df6ae53d5f7d4ac0cbbc0c7d84121b1202fe70df020bc6d8555aa9a4eb1680

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDCFA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD6A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
84KB

MD5
c91addcd44863e124c5ef9766e46751e

SHA1
863f17b99ff36c5397dcc475d7c9a6373c7984a9

SHA256
5093e83a3d46a465141f93f3034e3d45f0484b7d83a8bc32cdc1ab8011ddb2c7

SHA512
577e068a8cbc1f4cbe13311fbcf31704953943f5f3ae875e4edba089ef01d69dafbd0801eb2bc059305e7acfe11f5e0510c3a98b68689463569a60dd83a13871

Download Submit
memory/2648-9-0x0000000077480000-0x0000000077481000-memory.dmp

Filesize
4KB

Download
memory/2648-10-0x0000000000250000-0x000000000025F000-memory.dmp

Filesize
60KB

Download
memory/2648-11-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2648-8-0x000000007747F000-0x0000000077480000-memory.dmp

Filesize
4KB

Download
memory/2648-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download