ramnit | df905d542a4b227db23267ee402fbe992861b8f3e1ebbbbfcc4a048920a65358

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db19ce19154909d68cde4bcc70af4553_JaffaCakes118.html
Size

348KB
MD5

db19ce19154909d68cde4bcc70af4553
SHA1

b3d122a42cdb8da8645a1afa4bf1f89dc9541290
SHA256

df905d542a4b227db23267ee402fbe992861b8f3e1ebbbbfcc4a048920a65358
SHA512

7bc3d542affeab63a027059ca50777621b47d636b14245b455f91d0a3c0a1a291a1d06070a0890d5e51ef48c82e439d984e2bdb09f0ccf48d3ba10ae177a3015
SSDEEP

6144:hsMYod+X3oI+YnsMYod+X3oI+Y5sMYod+X3oI+YQ:t5d+X3V5d+X3f5d+X3+

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 6 IoCs

pid	Process
2872	svchost.exe
2836	DesktopLayer.exe
1804	svchost.exe
2896	DesktopLayer.exe
2964	svchost.exe
2176	DesktopLayer.exe

Loads dropped DLL 4 IoCs

pid	Process
2092	IEXPLORE.EXE
2872	svchost.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000018ab4-7.dat	upx
behavioral1/memory/2872-12-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2836-17-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1804-20-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px9241.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px90BB.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px91F3.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432245836"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000053c23e8f08f34a392435001167b0f5c670a6acf0a15a18f0a9b3ff3b4c26cee9000000000e8000000002000020000000cd7047b5656ccb2431d794c3902b9e8c78f9b3a82f9ce794629938395b2166e490000000303c7a82b9e0d439fc6af818d57af9eb68ee1925473642c83ea15e9d83ab9b91ce6bb989012f052d5a02797ca7b3f651b370081d503025fc3d3b79e3ea9453e5526288e7767f75391a980395fb905b38e8e11421fb2e329813654fa81e05844c415556ccae2deddc5860442f5fda54abe406bd757229ff80db5aa5d924f068f94d4997c35fb0d840d17fee6c51858ca440000000d93176ec14ae34f9b7643eabb1af3f3197a58ceda2aaa3c9d0dc8c8f9b88cfb0933d187a0759e2d400ef7de91fbfbb827deb0c7f41bccae3cff0c945c3506875	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0beec548304db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C044851-7076-11EF-A7B5-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000009088e52de175961eca79d399b616e7f5d377fb3f547397b08e1e89212640a029000000000e8000000002000020000000db5852ecd33e5f400166adbe9bddfdf3701e41fafcba479c54ba3049ba4737b0200000001cb07912d0b30f92746efa52ece9c82f4e01e52042cc593e8fa3135c395606ad40000000584708546567930b50f8884e545b4cfb0b50bb0bb337f5cf35691ce4125eda77caf95c579db4cb9a430a51f74c0aad5db50d968c07d7bcd8736d075bd2719144	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2836	DesktopLayer.exe
2836	DesktopLayer.exe
2836	DesktopLayer.exe
2836	DesktopLayer.exe
2896	DesktopLayer.exe
2896	DesktopLayer.exe
2896	DesktopLayer.exe
2896	DesktopLayer.exe
2176	DesktopLayer.exe
2176	DesktopLayer.exe
2176	DesktopLayer.exe
2176	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
1992	iexplore.exe
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
1992	iexplore.exe
1992	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
1992	iexplore.exe
1992	iexplore.exe
1992	iexplore.exe
1992	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2092	1992	iexplore.exe	30
PID 1992 wrote to memory of 2092	1992	iexplore.exe	30
PID 1992 wrote to memory of 2092	1992	iexplore.exe	30
PID 1992 wrote to memory of 2092	1992	iexplore.exe	30
PID 2092 wrote to memory of 2872	2092	IEXPLORE.EXE	31
PID 2092 wrote to memory of 2872	2092	IEXPLORE.EXE	31
PID 2092 wrote to memory of 2872	2092	IEXPLORE.EXE	31
PID 2092 wrote to memory of 2872	2092	IEXPLORE.EXE	31
PID 2872 wrote to memory of 2836	2872	svchost.exe	32
PID 2872 wrote to memory of 2836	2872	svchost.exe	32
PID 2872 wrote to memory of 2836	2872	svchost.exe	32
PID 2872 wrote to memory of 2836	2872	svchost.exe	32
PID 2836 wrote to memory of 1632	2836	DesktopLayer.exe	33
PID 2836 wrote to memory of 1632	2836	DesktopLayer.exe	33
PID 2836 wrote to memory of 1632	2836	DesktopLayer.exe	33
PID 2836 wrote to memory of 1632	2836	DesktopLayer.exe	33
PID 1992 wrote to memory of 2576	1992	iexplore.exe	34
PID 1992 wrote to memory of 2576	1992	iexplore.exe	34
PID 1992 wrote to memory of 2576	1992	iexplore.exe	34
PID 1992 wrote to memory of 2576	1992	iexplore.exe	34
PID 2092 wrote to memory of 1804	2092	IEXPLORE.EXE	35
PID 2092 wrote to memory of 1804	2092	IEXPLORE.EXE	35
PID 2092 wrote to memory of 1804	2092	IEXPLORE.EXE	35
PID 2092 wrote to memory of 1804	2092	IEXPLORE.EXE	35
PID 1804 wrote to memory of 2896	1804	svchost.exe	36
PID 1804 wrote to memory of 2896	1804	svchost.exe	36
PID 1804 wrote to memory of 2896	1804	svchost.exe	36
PID 1804 wrote to memory of 2896	1804	svchost.exe	36
PID 2896 wrote to memory of 2916	2896	DesktopLayer.exe	37
PID 2896 wrote to memory of 2916	2896	DesktopLayer.exe	37
PID 2896 wrote to memory of 2916	2896	DesktopLayer.exe	37
PID 2896 wrote to memory of 2916	2896	DesktopLayer.exe	37
PID 2092 wrote to memory of 2964	2092	IEXPLORE.EXE	38
PID 2092 wrote to memory of 2964	2092	IEXPLORE.EXE	38
PID 2092 wrote to memory of 2964	2092	IEXPLORE.EXE	38
PID 2092 wrote to memory of 2964	2092	IEXPLORE.EXE	38
PID 2964 wrote to memory of 2176	2964	svchost.exe	39
PID 2964 wrote to memory of 2176	2964	svchost.exe	39
PID 2964 wrote to memory of 2176	2964	svchost.exe	39
PID 2964 wrote to memory of 2176	2964	svchost.exe	39
PID 2176 wrote to memory of 2448	2176	DesktopLayer.exe	40
PID 2176 wrote to memory of 2448	2176	DesktopLayer.exe	40
PID 2176 wrote to memory of 2448	2176	DesktopLayer.exe	40
PID 2176 wrote to memory of 2448	2176	DesktopLayer.exe	40
PID 1992 wrote to memory of 2444	1992	iexplore.exe	41
PID 1992 wrote to memory of 2444	1992	iexplore.exe	41
PID 1992 wrote to memory of 2444	1992	iexplore.exe	41
PID 1992 wrote to memory of 2444	1992	iexplore.exe	41
PID 1992 wrote to memory of 1204	1992	iexplore.exe	42
PID 1992 wrote to memory of 1204	1992	iexplore.exe	42
PID 1992 wrote to memory of 1204	1992	iexplore.exe	42
PID 1992 wrote to memory of 1204	1992	iexplore.exe	42

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db19ce19154909d68cde4bcc70af4553_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1632
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2916
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2176
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:209932 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:537608 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:5321730 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
42bacbdf56184c2fa5fe6770857e2c2d

SHA1
521a63ee9ce2f615eda692c382b16fc1b1d57cac

SHA256
d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

SHA512
0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0891baeaae561ffcfc8f23438406ebbf

SHA1
1c9e8836c31f1c3b6daf105cdf8900115a7f529e

SHA256
5afd3936abd30695df53f063417d7144ffc01fba9a6207c1e94f2221e47cb3f7

SHA512
03c57e5b81c53282ed67c1897a06fe6fbc7ab96885600b3d16b2f89cdf252c3e7d57723671a1c0fb9b20e23cce53c0c5e769a2dedbac2de621bfb096c4b1d1e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
652c05319e4551af1caa43db0c58fc9f

SHA1
6146898d01037398fa5109c777d59772efa5363b

SHA256
b23567b80cf7329e95c0f4fb267a086cd4ec84745ed7367bcd162f47ed22ef5f

SHA512
284aa129cc7dab574bf9108cb766a9cfead022d2b3e11fa8daf59823976643ce9e7e83b5d26266b62dfd09ec3773a4eebeb90e1d0ba04bda7d4184085504bd24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af39abff07a1a2950ebcc282809c9b12

SHA1
8e2a8febd3ae6a97b1b1bf2fc0453bc4931d1163

SHA256
b555da8a5610b606bee68a8c7877953fa8f38b39a7b2d8958439444a31126a8d

SHA512
e828670c8e1af1e47a6205a32dc4e0dc83f984605df49032a08fe3b9313d3c1c062511264b731031d2b9169bfdc28ae0b966fafcf6283e92ccf39c323e06eaba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
468ce640a6974c912268278be86cd956

SHA1
1fe467fd47d079075ebf5bc2d22aed7564b02151

SHA256
6c30c7c8d9611136ff65b214d6702ca01a72b6c1d6cfabfca1c1ba7a93f986ed

SHA512
a004469d4c7089a3b3725f7d3b610d2fcbb273a1bfe951877efc0364f0975c1922154e1f9aa7e959810cd52f869881d37495603db879a661b55a7c1d964122f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5dcabb014b14c6ed27290ec8da30208

SHA1
8b41e7dcf3f13d5d9a6fbe6b77047a5823c3ba2b

SHA256
f4e48c674bdf1f8677197f0733cde9a6c614ac2eb5a0a0ab31363adcbd1c0375

SHA512
5ecd09f286a95bdb98b8e681e166e3920dd588b31c74360e3ebc59bab865e68573246f1c94ebb7f854c0e322167e9e0bcf5160aa104950b739b08614e3168913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
378ab19201462d70ea26420f2a5c6d55

SHA1
bc4fc8ad728d9143ad559d526a98935216dbf590

SHA256
5e7c75af52a7fd1df1a46cd25169327f0c72809242ac3a9f73bc66c6dc1e26d6

SHA512
d6d45bd93d6b101ea5aac3ce8ecd50e71f9b8af21e25299bf4be4f57eeba623a7f15852ca1632fa8b6d2eecd59422f0026c507f325645cef17b27913534eb163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e886e49819e15ed483b655220ce647de

SHA1
bdb04360317a632e3c07de4c8aaa7eb11b562a7a

SHA256
d5779bc046e6bb62481b64f0cd39c9aea48a64faf26be61dd1961c6f9e92dfe5

SHA512
95de4bca8bb90e9aa8d07a17940bd8c9f6bd3d22bcb6f2d248f683a5f309215f6251380e12e8ea24a809fbfc6d0c6a04a9e78070e4b44478ce00ad885faecade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47e8e1096b25f4897d68c4b77c4284ab

SHA1
2f183298c251de2f4e4218dfed83337eaaac9a32

SHA256
83b0e149c86769bf961051d72febadd71968fc956803f642e08f300bd092db49

SHA512
2d28cca92833e277e0c89a8feac5e1e68c614976101d2a4e8f3a08464e1119b38752028d861c64fd9ed23ec41858b99df52fb2cefa34286417198d922d3d1e09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
938e1b30b6a233ccec2592830d23409a

SHA1
332d0fe8677e5aae8be845570eecd7a05bd18219

SHA256
3141f5baa32f867b93b82c8f7cda3394efee1e948a253096ddc03a04adeec846

SHA512
2171cdd8870f651e66ad75c4398d0229753545b3c065ec436b4c1613ce933835aeb5d71707387a4f1d2204292958d388c0eface181dd02a031dc44e659b44c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C3B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E9E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1804-20-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1804-21-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/2176-36-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2836-17-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2836-15-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2872-12-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download