ramnit | b5586ceff8b79de7fd4489b8e619046bd90398b6b627f21e8f92179d110c9054

Analysis

max time kernel
127s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e06caf4ec191b355ea2f71e652e23f39_JaffaCakes118.html
Size

2.3MB
MD5

e06caf4ec191b355ea2f71e652e23f39
SHA1

7aee2b3b18b9a0632775ca136933e1d864c7b492
SHA256

b5586ceff8b79de7fd4489b8e619046bd90398b6b627f21e8f92179d110c9054
SHA512

b7a249706f117f51602ffe066617d6a9ea6adcbe06979717b0a38dd467366f9590b4392615ecb2ae509cb9be07666526880587d66a30c9542cb5ab63ddf94091
SSDEEP

24576:L+Wt9BJ+Wt9Bq+Wt9B9+Wt9BF+Wt9Bt+Wt9B1+Wt9B5+Wt9Bi+Wt9BX+Wt9Bz+W2:m

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 26 IoCs

pid	Process
2124	svchost.exe
2876	DesktopLayer.exe
2212	FP_AX_CAB_INSTALLER64.exe
920	svchost.exe
2544	DesktopLayer.exe
2028	svchost.exe
660	DesktopLayer.exe
1748	svchost.exe
1684	DesktopLayer.exe
2096	svchost.exe
292	svchost.exe
2232	DesktopLayer.exe
1484	svchost.exe
524	DesktopLayer.exe
2952	svchost.exe
2812	svchost.exe
2808	svchost.exe
2792	DesktopLayer.exe
1600	FP_AX_CAB_INSTALLER64.exe
824	svchost.exe
2812	DesktopLayer.exe
2120	svchost.exe
2940	svchost.exe
2972	DesktopLayer.exe
1296	svchost.exe
1208	DesktopLayer.exe

Loads dropped DLL 17 IoCs

pid	Process
2668	IEXPLORE.EXE
2124	svchost.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000194d7-2.dat	upx
behavioral1/memory/2876-16-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2124-8-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2876-17-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2876-19-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2876-21-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2876-23-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2028-138-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/1684-152-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/292-216-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxF1CE.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF21C.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF3F0.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF42E.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxD088.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF1ED.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF3B2.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF9AA.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF364.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF97C.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxCD6D.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF354.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF44E.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF9E9.tmp	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	IEXPLORE.EXE
File opened for modification	C:\Windows\Downloaded Program Files\SETF19F.tmp	IEXPLORE.EXE
File created	C:\Windows\Downloaded Program Files\SETF19F.tmp	IEXPLORE.EXE
File opened for modification	C:\Windows\Downloaded Program Files\swflash64.inf	IEXPLORE.EXE
File opened for modification	C:\Windows\Downloaded Program Files\SETF93E.tmp	IEXPLORE.EXE
File created	C:\Windows\Downloaded Program Files\SETF93E.tmp	IEXPLORE.EXE

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FP_AX_CAB_INSTALLER64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FP_AX_CAB_INSTALLER64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000535304d650a2b046af3c27f21f5048ec000000000200000000001066000000010000200000009e3e710f6ccb4601cf22eb0ccfd471cb91af293a63f8eff5a143cda354c2f20b000000000e80000000020000200000006bb28fe91a878325859ea51744ff5bb53ee952fed72abb9b90dfa81451b15472900000006f3e73e3b3380247d1cb135d31bb8b62997ed62dee809ce5c7bc0b323b7c9dbe3bfba5a64606f4e679bffc03612927afd1754bbe1677cfee3d120c44ae5ecd8d5a3af248ec13b6251cf31a837f27573465775f8aa20abdb4760025b54bcd53398b8d4e373ecd8992c245e9a3e79967ef35145b1993ff40fbcfba142fa607e1d01069a7e83547d4028df635cb68a1181c400000004c9cfb8a4419808ab28e83f5af998585be3aceaaf7fadb2535dc9db44c0e7ab480ed64aee31312775bcc29648fe3ef8a98cd7cb07d8cc5ff45ac09e99552c7ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6400000019000000ea0400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DD563E1-B790-11EF-B462-D60C98DC526F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000535304d650a2b046af3c27f21f5048ec00000000020000000000106600000001000020000000675ea0325da7d9c908aadbc8e6edb3a0185418e25d8fae2fe6f6308f197b2e18000000000e80000000020000200000003fbf5b592918bfc8419af3a74b442ee116e235f5e554bf64fb60275681a9104020000000fef2b1dcb37013ba6bdcf8371fe1cb81df905b2ca18a86c538ea1e081a17db7340000000cbb1e615e3ebe8aaaed4f61d5b31ac22ce25f01269e60c4d288ccecb06a8262b223a10a85b52b0fb798981ea840920420ece7d688571a0f5e543117ef61c523e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff4b00000000000000d104000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b045b4719d4bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440063591"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2876	DesktopLayer.exe
2876	DesktopLayer.exe
2876	DesktopLayer.exe
2876	DesktopLayer.exe
2212	FP_AX_CAB_INSTALLER64.exe
2544	DesktopLayer.exe
2544	DesktopLayer.exe
2544	DesktopLayer.exe
2544	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
660	DesktopLayer.exe
1684	DesktopLayer.exe
1684	DesktopLayer.exe
1684	DesktopLayer.exe
1684	DesktopLayer.exe
292	svchost.exe
292	svchost.exe
292	svchost.exe
292	svchost.exe
2232	DesktopLayer.exe
2232	DesktopLayer.exe
2232	DesktopLayer.exe
2232	DesktopLayer.exe
524	DesktopLayer.exe
524	DesktopLayer.exe
524	DesktopLayer.exe
524	DesktopLayer.exe
2952	svchost.exe
2952	svchost.exe
2952	svchost.exe
2952	svchost.exe
2808	svchost.exe
2808	svchost.exe
2808	svchost.exe
2792	DesktopLayer.exe
2808	svchost.exe
2792	DesktopLayer.exe
2792	DesktopLayer.exe
2792	DesktopLayer.exe
1600	FP_AX_CAB_INSTALLER64.exe
2812	DesktopLayer.exe
2812	DesktopLayer.exe
2812	DesktopLayer.exe
2812	DesktopLayer.exe
2120	svchost.exe
2120	svchost.exe
2120	svchost.exe
2120	svchost.exe
2972	DesktopLayer.exe
2972	DesktopLayer.exe
2972	DesktopLayer.exe
2972	DesktopLayer.exe
1208	DesktopLayer.exe
1208	DesktopLayer.exe
1208	DesktopLayer.exe
1208	DesktopLayer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2668	IEXPLORE.EXE
Token: SeRestorePrivilege	2668	IEXPLORE.EXE
Token: SeRestorePrivilege	2668	IEXPLORE.EXE
Token: SeRestorePrivilege	2668	IEXPLORE.EXE
Token: SeRestorePrivilege	2668	IEXPLORE.EXE
Token: SeRestorePrivilege	2668	IEXPLORE.EXE
Token: SeRestorePrivilege	2668	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
1956	iexplore.exe
1956	iexplore.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
1956	iexplore.exe
1956	iexplore.exe
576	IEXPLORE.EXE
576	IEXPLORE.EXE
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
692	IEXPLORE.EXE
692	IEXPLORE.EXE
1956	iexplore.exe
1956	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
1956	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE
872	IEXPLORE.EXE
872	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2668	1956	iexplore.exe	30
PID 1956 wrote to memory of 2668	1956	iexplore.exe	30
PID 1956 wrote to memory of 2668	1956	iexplore.exe	30
PID 1956 wrote to memory of 2668	1956	iexplore.exe	30
PID 2668 wrote to memory of 2124	2668	IEXPLORE.EXE	31
PID 2668 wrote to memory of 2124	2668	IEXPLORE.EXE	31
PID 2668 wrote to memory of 2124	2668	IEXPLORE.EXE	31
PID 2668 wrote to memory of 2124	2668	IEXPLORE.EXE	31
PID 2124 wrote to memory of 2876	2124	svchost.exe	32
PID 2124 wrote to memory of 2876	2124	svchost.exe	32
PID 2124 wrote to memory of 2876	2124	svchost.exe	32
PID 2124 wrote to memory of 2876	2124	svchost.exe	32
PID 2876 wrote to memory of 2084	2876	DesktopLayer.exe	33
PID 2876 wrote to memory of 2084	2876	DesktopLayer.exe	33
PID 2876 wrote to memory of 2084	2876	DesktopLayer.exe	33
PID 2876 wrote to memory of 2084	2876	DesktopLayer.exe	33
PID 1956 wrote to memory of 2620	1956	iexplore.exe	34
PID 1956 wrote to memory of 2620	1956	iexplore.exe	34
PID 1956 wrote to memory of 2620	1956	iexplore.exe	34
PID 1956 wrote to memory of 2620	1956	iexplore.exe	34
PID 2668 wrote to memory of 2212	2668	IEXPLORE.EXE	37
PID 2668 wrote to memory of 2212	2668	IEXPLORE.EXE	37
PID 2668 wrote to memory of 2212	2668	IEXPLORE.EXE	37
PID 2668 wrote to memory of 2212	2668	IEXPLORE.EXE	37
PID 2668 wrote to memory of 2212	2668	IEXPLORE.EXE	37
PID 2668 wrote to memory of 2212	2668	IEXPLORE.EXE	37
PID 2668 wrote to memory of 2212	2668	IEXPLORE.EXE	37
PID 2212 wrote to memory of 1792	2212	FP_AX_CAB_INSTALLER64.exe	38
PID 2212 wrote to memory of 1792	2212	FP_AX_CAB_INSTALLER64.exe	38
PID 2212 wrote to memory of 1792	2212	FP_AX_CAB_INSTALLER64.exe	38
PID 2212 wrote to memory of 1792	2212	FP_AX_CAB_INSTALLER64.exe	38
PID 1956 wrote to memory of 576	1956	iexplore.exe	39
PID 1956 wrote to memory of 576	1956	iexplore.exe	39
PID 1956 wrote to memory of 576	1956	iexplore.exe	39
PID 1956 wrote to memory of 576	1956	iexplore.exe	39
PID 2668 wrote to memory of 920	2668	IEXPLORE.EXE	40
PID 2668 wrote to memory of 920	2668	IEXPLORE.EXE	40
PID 2668 wrote to memory of 920	2668	IEXPLORE.EXE	40
PID 2668 wrote to memory of 920	2668	IEXPLORE.EXE	40
PID 920 wrote to memory of 2544	920	svchost.exe	41
PID 920 wrote to memory of 2544	920	svchost.exe	41
PID 920 wrote to memory of 2544	920	svchost.exe	41
PID 920 wrote to memory of 2544	920	svchost.exe	41
PID 2544 wrote to memory of 1688	2544	DesktopLayer.exe	42
PID 2544 wrote to memory of 1688	2544	DesktopLayer.exe	42
PID 2544 wrote to memory of 1688	2544	DesktopLayer.exe	42
PID 2544 wrote to memory of 1688	2544	DesktopLayer.exe	42
PID 2668 wrote to memory of 2028	2668	IEXPLORE.EXE	43
PID 2668 wrote to memory of 2028	2668	IEXPLORE.EXE	43
PID 2668 wrote to memory of 2028	2668	IEXPLORE.EXE	43
PID 2668 wrote to memory of 2028	2668	IEXPLORE.EXE	43
PID 2028 wrote to memory of 660	2028	svchost.exe	44
PID 2028 wrote to memory of 660	2028	svchost.exe	44
PID 2028 wrote to memory of 660	2028	svchost.exe	44
PID 2028 wrote to memory of 660	2028	svchost.exe	44
PID 660 wrote to memory of 740	660	DesktopLayer.exe	46
PID 660 wrote to memory of 740	660	DesktopLayer.exe	46
PID 660 wrote to memory of 740	660	DesktopLayer.exe	46
PID 660 wrote to memory of 740	660	DesktopLayer.exe	46
PID 2668 wrote to memory of 1748	2668	IEXPLORE.EXE	45
PID 2668 wrote to memory of 1748	2668	IEXPLORE.EXE	45
PID 2668 wrote to memory of 1748	2668	IEXPLORE.EXE	45
PID 2668 wrote to memory of 1748	2668	IEXPLORE.EXE	45
PID 1748 wrote to memory of 1684	1748	svchost.exe	47

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e06caf4ec191b355ea2f71e652e23f39_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2084
- - C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
    C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://get3.adobe.com/flashplayer/update/activex
      4⤵
      PID:1792
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1688
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:660
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:740
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1684
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2816
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2096
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2232
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3056
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:292
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2856
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1484
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:524
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1064
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2952
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1080
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2812
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2792
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:3000
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2808
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:836
- - C:\Users\Admin\AppData\Local\Temp\ICD2.tmp\FP_AX_CAB_INSTALLER64.exe
    C:\Users\Admin\AppData\Local\Temp\ICD2.tmp\FP_AX_CAB_INSTALLER64.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1600
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://get3.adobe.com/flashplayer/update/activex
      4⤵
      PID:2832
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:824
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2812
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1972
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2120
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1752
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2940
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2972
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2332
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1296
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1208
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:1324038 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:3945484 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:1324056 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:7222276 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:7353346 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:7812097 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:1586194 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:2896948 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
13579b26af3d993f7f4d17de235bd183

SHA1
5061e7b1e11e0a6fa6612928109a231f3e241a1b

SHA256
06fed901bc1b716c13e6c4ba1f38f026347d4d97f69f3c663209a2da1fdff50c

SHA512
50c3639bf23c72a2035906deed8562c6bafb4ab21f398ab3c0f5aa14b8c0fe983594b301d447fbca4accd90b43cd90036042b1a41598d5f0ebdfc9d718fe5a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10777d3f76d68eac3a5bb4f98fef8928

SHA1
270ab62d86453d6b77ba222b20537af4f9644a21

SHA256
ddfc1daef2bab8d6e164e7076029e3ae48612bff1d4c462694559671e5528233

SHA512
81f3240eaf60f5c00cc4b540cd01e247448844334f0b0d3fcd8a35c6071500d991826b3a43ceeb6d29fc890a754cb5e81a2da2f60301ba4fa6abeee308f97621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa9cfb4b75ef096a16250b9ccb577f25

SHA1
3b231f80c28e2fa319050474938d1500ad83ad8f

SHA256
658b8882f6a2a5bbfc40209182cffbc79621790b130fda24cc59bba26ac5c7b0

SHA512
446b155e022c38f4654e86f633cf9c1567eae2abe904d7b08bb5c9db22ef8b4b27aa32c6ee46e8f0da448fd9212e2efa1ddb4d7dca4074ba2b35e68dd89004c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53d97df9bac797e04ea999baf40847f9

SHA1
7f06872c7a7a899e42724d7944457e6df08c632d

SHA256
45f89b0826557d16daebef3eb123ace5c8d901e40fd578061d4f5c46dc270e6c

SHA512
a89ec7efcf406a49aea1c424715b1c9443c1436c292853de4af30ab70b55d3017ad2c4c0950d9abdf56687dc241495f903648c54aa56cbf43ff19131b25220a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a94c4984eb6931b09ef5a14b5c66591a

SHA1
c01b0b017ca0082fcd564b8f5e742e9b69367e0c

SHA256
60fd330ed2d5b0055fa0397d103530e4d6d9bcbf97863dcb2262462ce2b93096

SHA512
5468dd7c742d5d820418f728524143a5aa0b5d2c945970c4d96270fcee7842fd6cff88ef3f08d9e9b505152f402968142223aea145765ac149845729def9dd6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3ea42040e59264de85be08b76137042

SHA1
1e7bece40544bd29084a25ba3014f1008200f37c

SHA256
0c3e8bcb9ec4fcbf78ec4e47982d25cd8e25859dc2517549eed6cf630399e5fe

SHA512
20647c4557f80a85e53da361f855a039bc0998d8df71f2803f0338964d964c786b427000a554ea9916fd5d2fdf391c2b9722a8bbfd1f141efc872f0d4991a2cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06fda84a461dcb80d383171558d1b4c4

SHA1
eeab9ece2cbd7db0e1457eac998d84a2bb21e454

SHA256
de146ecc4cc3925b118d77046a76b4203ae6010fc1194e8b2762a289646d24a8

SHA512
0bfcb3b9d467dcc34f9e9b56d4a857b48236e10dfc6857a72b166ff27a97cc3f2f1c95afb6a82aeadc33287eba005388dfb6e307ad8e232a72e24292e3ec8033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34e14ac1ae7c75b744ae5bbe8b8a5bb

SHA1
3301cecd1b12e68daaa16e49cb44a21637e74090

SHA256
292817b4363c514d8477031a28a7675bae3d67d2348a7f7b575ed725cdf88ce6

SHA512
8eed3d61adf41d1ced23eb078ec664d15dcfb0dba1f91f5d04902bdbc82758426dcaaab9e1cb75776fec911e7b8f786695a194bb9f42d925456a8585b4716803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7d1c00c2af197e9905928fff1b4f69a

SHA1
7e371b539f5587d7eeb926bb5fa69a86746c570b

SHA256
f7821581f4d8fdfd73bca1f36c3513cf9f87399581769e1cc568e645fd79e669

SHA512
5ac40534f397431f613c832498e544da59d1baea3cda268973442e00e8324a57bb73e35649c1416c7b4af35fc55e13b25f9134f87cab4dc8f47156abf3f477d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35a0199d261d4cb8e8f91333915a7a08

SHA1
c39afdb7c7301bed188db3d8e9ff51ab8abef423

SHA256
0a1f847ba32565e9f6a9365ba208551413537351d026ac61810ee6ac1a7a46eb

SHA512
a9b0dbe04763d9d71cf64ea1b371379750fd713482fe5ee2ccc20dd0e0fa405484427f1c7d5bbed7bed25d4b6d4fc972b6e69f6d8c5fa1e762ea44de355bb427

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cf9f28e19b801fcc56b53c0e3c8cce7

SHA1
76490c180daa1ee1646bf3b37176edd24e8d65f4

SHA256
616c3872b8b0d828b4a5791b0815be1d2da4eb0c4ef50d48af60555ca514ec47

SHA512
341349827228d33242a8823843347b746f610ea046f62a2cb46988bb91d1ff59cdce72013edd0cfe34aa3e49f835ea00cbd627700b086f4a8b768ced73ba54f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
436c90fbdf9fab3b759043c017a3c24d

SHA1
77f0b65ac239c9980d8498a817dad6e471ac1c33

SHA256
c0ba160f649f134c69ba819802401d846b7924532a55affb69c7fadd906e95ac

SHA512
95785adeb2019da132b634769772d4c06e277fa414ea2c32adf0dbe150e10efec2a5e5a2fbe17b8c53afef70c7fecf03d667d7e7cf896ddaf38521821b6e9296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b16e369dc24289e333eb6bfedf37175a

SHA1
539a2875af16b3d1379bd25d01c7f08154f1016c

SHA256
d5962dc54523670dd379b90aafcf1821409072e7922a72a0cd76c93fd1f19f91

SHA512
312fc2e927c467ea39d27de12d63a7cc436a9fc8430d2da0f8ea0af6db7267306ce8f35cb2ab7609dce279c0629e79751293db47f6b988ecc92ce43d8e17bc09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e42e7b0f29697f0aac8852fa41008288

SHA1
53286e2b89d76680a13e7adb979e78863d293101

SHA256
74a7d7c6a397ae1552d1054d4a691cd179074517ed4c6eaf278eba450248e6df

SHA512
e5db1ca664c8142fe25d40152ed33b44b2aea6146651912eec11dadf8fc2b371beef005bf6ecf3b22b76377c4b00fe0fb0e479c66543d9939c5b0e4cd27b1b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cd66006b95842e77a062416174dc492

SHA1
76eb8c760a69aa34b7689b6b9452bf35a5ecc031

SHA256
94a118fc79fcdc9138e0dfbb678ebaf7f073f637c1fa7ea940f4decea7453cf4

SHA512
e2dce6830d06a1110bf14cd02e04477166a58eb3be7447cd035d29c5cae479403f2563d8be92b56163cc7980bde45b4584e94a687d847ba6ce5622b4cc958002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12dbcfa24870349f0d197585a27dc0c9

SHA1
ba29c15a696df12b71632bdb44dd82215676b97c

SHA256
b60267a870017657f4240483798c40a45df5e430a53bb97e5f32662531954185

SHA512
4bf7f6710e8a2038fc1640ebd35de97b604ab317511641ebdcaab63abc7ff93b03f9eb310e60e55f86a749b771df49b74a445b5091ee660acc9b2ab18ad8449d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0a949b7638a71ac712540022b17811a

SHA1
29e090400c3df73b2d7d8b791a70b36fcd9f2bd6

SHA256
67bb060c5260e6d0af8ae379292077422be3c37ef74a30ea069aad49b6f54912

SHA512
6364514d290fd16d6f52e2f177d8806e870b10b337e06b245ecb22eb98aee9b20ff345ee7f76d4bcde6a56bfb3cef0c1cec546d1c33ff386064e8545de125475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba18bae066e171387b605013dddcf3d6

SHA1
1f454266d629fb317631d2fe3f3011ecddfaff3d

SHA256
b46057a873f5bb764eedbf8ffc5dc655d94f5fa210c3e9c561a1d6a31a6683fe

SHA512
121e1d2fbf023b4e081004c57522d04c5ccc2afd82f9e420d4170dfcaf3ba22f0abebbe15be55046e2ae53b45e6ed9757422c77dfd84643a56b8c56f29ac5173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e8cd8672b6519636b7d997439be3b26a

SHA1
74196b224c57dfeb7889089c8af152e71b42f2c7

SHA256
a115532574e80aac2f0ef390690f55dc0b1c14fe75a74e27ccac2f5a79fdf56b

SHA512
cfa0fa86a770d52927f00c5fd5b081f554962d5941a8813a59c7a1b8ad9578574209e86d8cfd47ae6d2414d1259e8ef73705f809c3187a1d38c8e7c810988d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\swflash[1].cab

Filesize
225KB

MD5
b3e138191eeca0adcc05cb90bb4c76ff

SHA1
2d83b50b5992540e2150dfcaddd10f7c67633d2c

SHA256
eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b

SHA512
82b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE63C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\swflash64.inf

Filesize
218B

MD5
60c0b6143a14467a24e31e887954763f

SHA1
77644b4640740ac85fbb201dbc14e5dccdad33ed

SHA256
97ac49c33b06efc45061441a392a55f04548ee47dc48aa8a916de8d13dabec58

SHA512
7032669715c068de67d85d5d00f201ee84bb6edac895559b2a248509024d6ce07c0494835c8ee802dbdbe1bc0b1fb7f4a07417ef864c04ebfaa556663dfd7c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB00.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

Filesize
757KB

MD5
47f240e7f969bc507334f79b42b3b718

SHA1
8ec5c3294b3854a32636529d73a5f070d5bcf627

SHA256
c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11

SHA512
10999161970b874db326becd51d5917f17fece7021e27b2c2dfbee42cb4e992c4d5dbeac41093a345ad098c884f6937aa941ec76fb0c9587e9470405ecb67161

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
83KB

MD5
c5c99988728c550282ae76270b649ea1

SHA1
113e8ff0910f393a41d5e63d43ec3653984c63d6

SHA256
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

SHA512
66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

Download Submit
memory/292-216-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/524-230-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/660-144-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1684-154-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1684-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2028-138-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2124-12-0x0000000000250000-0x0000000000285000-memory.dmp

Filesize
212KB

Download
memory/2124-9-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/2124-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2544-134-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2876-17-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2876-19-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2876-21-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2876-20-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2876-23-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2876-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2952-232-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download