ramnit | ed0b4d4e31f572bffa5c56c0c7677ec6b670e22af504a94d2e1830cab3f5c676

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed0b4d4e31f572bffa5c56c0c7677ec6b670e22af504a94d2e1830cab3f5c676.dll
Size

3.3MB
MD5

f58610835801009cf7ba115604f94905
SHA1

03d36617604c72a22fb187a576504b4c2b594359
SHA256

ed0b4d4e31f572bffa5c56c0c7677ec6b670e22af504a94d2e1830cab3f5c676
SHA512

bb5736839cf7589c5e50394f2531e1a6047126dc489d02b66e2182918e06f499222cdb8ce9e600550811889ec5384a8b6063d2fd9c912e0a23a72686eba1bf7e
SSDEEP

12288:CclekxppkfkjJ13OuHnsaxS7Z/d3QPn/6nwS+sByjgopluSZJ2yVsjmIG+3pF0AF:DJ13bsao/d3QH6nway/5Z5Ih09T

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 4 IoCs

pid	Process
2972	rundll32Srv.exe
2404	rundll32SrvSrv.exe
2584	DesktopLayer.exe
2232	DesktopLayerSrv.exe

Loads dropped DLL 4 IoCs

pid	Process
1640	rundll32.exe
2972	rundll32Srv.exe
2972	rundll32Srv.exe
2584	DesktopLayer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32SrvSrv.exe	rundll32Srv.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001925c-19.dat	upx
behavioral1/files/0x00070000000120fe-10.dat	upx
behavioral1/memory/2972-17-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2232-35-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2232-38-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2584-31-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2404-26-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32SrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxAC08.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxAB9B.tmp	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxABBA.tmp	rundll32SrvSrv.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	1640	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32Srv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32SrvSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayerSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442040726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEDB8861-C98B-11EF-A97E-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FED6C5A1-C98B-11EF-A97E-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2404	rundll32SrvSrv.exe
2404	rundll32SrvSrv.exe
2404	rundll32SrvSrv.exe
2404	rundll32SrvSrv.exe
2584	DesktopLayer.exe
2584	DesktopLayer.exe
2584	DesktopLayer.exe
2584	DesktopLayer.exe
2232	DesktopLayerSrv.exe
2232	DesktopLayerSrv.exe
2232	DesktopLayerSrv.exe
2232	DesktopLayerSrv.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1960	iexplore.exe
2832	iexplore.exe
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2832	iexplore.exe
2832	iexplore.exe
2756	iexplore.exe
2756	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1640	2012	rundll32.exe	30
PID 2012 wrote to memory of 1640	2012	rundll32.exe	30
PID 2012 wrote to memory of 1640	2012	rundll32.exe	30
PID 2012 wrote to memory of 1640	2012	rundll32.exe	30
PID 2012 wrote to memory of 1640	2012	rundll32.exe	30
PID 2012 wrote to memory of 1640	2012	rundll32.exe	30
PID 2012 wrote to memory of 1640	2012	rundll32.exe	30
PID 1640 wrote to memory of 2972	1640	rundll32.exe	31
PID 1640 wrote to memory of 2972	1640	rundll32.exe	31
PID 1640 wrote to memory of 2972	1640	rundll32.exe	31
PID 1640 wrote to memory of 2972	1640	rundll32.exe	31
PID 2972 wrote to memory of 2404	2972	rundll32Srv.exe	32
PID 2972 wrote to memory of 2404	2972	rundll32Srv.exe	32
PID 2972 wrote to memory of 2404	2972	rundll32Srv.exe	32
PID 2972 wrote to memory of 2404	2972	rundll32Srv.exe	32
PID 2972 wrote to memory of 2584	2972	rundll32Srv.exe	33
PID 2972 wrote to memory of 2584	2972	rundll32Srv.exe	33
PID 2972 wrote to memory of 2584	2972	rundll32Srv.exe	33
PID 2972 wrote to memory of 2584	2972	rundll32Srv.exe	33
PID 1640 wrote to memory of 2564	1640	rundll32.exe	34
PID 1640 wrote to memory of 2564	1640	rundll32.exe	34
PID 1640 wrote to memory of 2564	1640	rundll32.exe	34
PID 1640 wrote to memory of 2564	1640	rundll32.exe	34
PID 2404 wrote to memory of 1960	2404	rundll32SrvSrv.exe	35
PID 2404 wrote to memory of 1960	2404	rundll32SrvSrv.exe	35
PID 2404 wrote to memory of 1960	2404	rundll32SrvSrv.exe	35
PID 2404 wrote to memory of 1960	2404	rundll32SrvSrv.exe	35
PID 2584 wrote to memory of 2232	2584	DesktopLayer.exe	36
PID 2584 wrote to memory of 2232	2584	DesktopLayer.exe	36
PID 2584 wrote to memory of 2232	2584	DesktopLayer.exe	36
PID 2584 wrote to memory of 2232	2584	DesktopLayer.exe	36
PID 2584 wrote to memory of 2756	2584	DesktopLayer.exe	37
PID 2584 wrote to memory of 2756	2584	DesktopLayer.exe	37
PID 2584 wrote to memory of 2756	2584	DesktopLayer.exe	37
PID 2584 wrote to memory of 2756	2584	DesktopLayer.exe	37
PID 2232 wrote to memory of 2832	2232	DesktopLayerSrv.exe	38
PID 2232 wrote to memory of 2832	2232	DesktopLayerSrv.exe	38
PID 2232 wrote to memory of 2832	2232	DesktopLayerSrv.exe	38
PID 2232 wrote to memory of 2832	2232	DesktopLayerSrv.exe	38
PID 1960 wrote to memory of 2784	1960	iexplore.exe	39
PID 1960 wrote to memory of 2784	1960	iexplore.exe	39
PID 1960 wrote to memory of 2784	1960	iexplore.exe	39
PID 1960 wrote to memory of 2784	1960	iexplore.exe	39
PID 2832 wrote to memory of 2656	2832	iexplore.exe	40
PID 2832 wrote to memory of 2656	2832	iexplore.exe	40
PID 2832 wrote to memory of 2656	2832	iexplore.exe	40
PID 2832 wrote to memory of 2656	2832	iexplore.exe	40
PID 2756 wrote to memory of 2664	2756	iexplore.exe	41
PID 2756 wrote to memory of 2664	2756	iexplore.exe	41
PID 2756 wrote to memory of 2664	2756	iexplore.exe	41
PID 2756 wrote to memory of 2664	2756	iexplore.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed0b4d4e31f572bffa5c56c0c7677ec6b670e22af504a94d2e1830cab3f5c676.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed0b4d4e31f572bffa5c56c0c7677ec6b670e22af504a94d2e1830cab3f5c676.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\SysWOW64\rundll32SrvSrv.exe
      C:\Windows\SysWOW64\rundll32SrvSrv.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2784
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
        
        "C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2232
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2656
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2756
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 252
    3⤵
    - Program crash
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
228bd92aae2bd94473fb59c7d7d38672

SHA1
a61fb54284a8a54f24426906da386a7d07049622

SHA256
153b657a46dfdfbc14046d1df43195986299f05b7fee6ca7dc94f305c700c989

SHA512
24c7e6d5f6baa9ae3ffe5094aae612ea4544d276bf9587d9955dc18c0ebd4dda391ff1867ff7f6165b1bd25a1d1d9e5ed49f077a01c2b07a31b21d0714b83d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b59457f9710e424e6d9ec95b3bc9ba0a

SHA1
021fa3b0f5c247451cc9d218555037903a5968a4

SHA256
5a22006d7cf414fdeabd08ffd303c926a808f92b82e2d5c8c08a6b43b9ac7dc1

SHA512
0b3951a5c8415cb6b8823758575bec57fedf3c7668df9443e8581b2d5ebac1934a9f91ecb1e8894c119d0cd436db7bd5b7a0ef5ac731291d0d8f716c91d1a81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a407792d8c287092869c815cac6e4cf

SHA1
1c85db0a39357537fe98ed925c3980f6aa009d18

SHA256
bec3462bcd16633d202b5d0e4cf477e3dbbd3156a647433e6a95a0341ba8fc7f

SHA512
bd2ca092ff3de08d6f911a394644cb6959fa4503ce17a283c3cd23214795f5e15cfcb015f0beeebf82d3df3cb2786b96de0c3b174ca7dcf91f9ed6c478998f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38afaf258a54c6253111760c20bd1aa4

SHA1
52ce3897615440e04e1b869817847eb6a30d6f14

SHA256
e904ab670f10d82297c5bd18430a27183fe5d48d1b1597853ef4976bb024b8a5

SHA512
819eadb846cd0a50527b98e1fcf4b1f508a9668b9e8184b4bd1c91f3ef2aa4050f9b875139defb81b0ad224b94ac23c5b98c4c072388a521e34e6f456684c4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8031ff43c68c7ee6f6113adbdb1124fd

SHA1
1cea8db4798667f85d07a32def06cbac24177f2c

SHA256
6d3a72d56f3fbd8363cf221421f93825bd8f6dd71f5678964333e6c84690e8e5

SHA512
5035e7b40785229e52196c4c7c45fd12664a741127b0e20ab8b1cd5c90b5047f84c840c23b0eba837a899225dc2636818c98b9e86bd172f363d2293182db2653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
486d6bc6aa0a0e944b7aaac351e75417

SHA1
b44cd9f37ed657d4f831de1b5a3731fd01784aca

SHA256
e3bc18b60d206fc18ee3c4a80f70c90f24ad3a5985a41e44062f6d0690d831de

SHA512
8d6dd133369838a398239616d0d0542146d59ba96c3577545ffe2ef7c416303ebcb4697c6acbffc268646f1514d33c56601ff0e4295107f3ec238b074b32d121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
408500bfb3a9ea2f8ff84e27ed36a007

SHA1
56c7b07a2cd3fc5a7310c75bc7269e3681e84080

SHA256
825bd09a89f6c1a80f482ed48a7647eebe8fb30eea16251cf23b8ba994a4005d

SHA512
538ca53b24176becb7ecdd15257c831444209d5d220bddeb4926730f756f4f300f7f7424eef69f8158c6be4bf56b0eaea53424b8bdfdc14c20f4c172ea522735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
278e9f6af53b9906e12e9e9c659ef00c

SHA1
947c0915b19b36091981f37417c079735b2c5f54

SHA256
62cc51ad5e9046e95e00f7dcda9377a85a9cd1131c52b598e493da17b74c31f3

SHA512
a8f80d5a713dae93d2932bf91f8ffd5d3917509473918957da38a2c8bc09d5ed49acd4d2401e08f39c83af965610efd7808c9c43297861005a9d9fe99b044eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f673c0efd332cc0f5e67345409dfda0a

SHA1
6059a73c215f992c018f6e5c4545ce5b7027b6ad

SHA256
dba75e97bba960d4baeaab065ae9f62bc3b457876e9b6b18d9bdf3192b272fca

SHA512
ed7cddd2aa5e579ba08965c6d02f42ed62984544c31a3e9c4f7827820b06491fa42553249a8c443bb5432b4bf346719287c45a1c80a369158f462ffc47333419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98447f35807d935b72052f9df11c2573

SHA1
a4c05c5c58df1258b65f9db923ba5cbd3342a8e4

SHA256
917fe60d274ae301b7b87e4b9b199f2a183b3a0c5966bde40a10594b95f85252

SHA512
3a112c4edf280f87a109db6ba5e7a94e192877bec7d57e179a50f09161b9b70528d52e18d865f00f7f2f95b0387246969e0d6fba19b47f1d28c28cfffe400039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
630f88a110992c7df3a7fd8057e9a1b3

SHA1
50b63e6ff26bf256deaed25cdbf59e6395e7948e

SHA256
11644c2c4e3fd12acebfc8435f9f56609fc5fd0b6570ce4ff387f2e0d7fcbb22

SHA512
9a327a9fc80c6be6aab6d9ffb66159f08bdee8611d00167528e8968e08e4da3c437cc2e0400a725e4fd5af9a9a585407ba93687af4fb8e7bd3b9735df8b3ffb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3bf67d3b339e1f21bdcd417917d58a7

SHA1
e1249a0866b44089647df1dd16ee29892165e3e5

SHA256
0d6a9dc8cf21d87d023fd8a4b806f6049b6ee73ca7715232f49a092e6630c9bb

SHA512
a2e1a103ea818144cd7e4e232ed8d1f077e986edf06df506c51ebe887c108c578278a1edc0fcbc6fad8d4682253ae648cf64ac4b60cf417b9fa4de5fe1a24454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11e42abea046de52320270ab7d8a2b97

SHA1
b54a137768c75271a019362d407d09f3c01fbecd

SHA256
1a7a206613780f36446a5cf1812cd07a1672542b7c7ec5bf199583f74686806a

SHA512
91c1bbae9e388baaaed28aab5d9585f4a295405a603fdc21257dd05ea1eca21dc281e629cc8b8bc492da8386c2551743344a5a595b46a9e2ac550f1364a6a6a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea08bf2bb144d573969c0c1305b3117

SHA1
40935fd7776ede43541d5a07bd4f8faf2e16fa60

SHA256
eef9ce4815201074261fa65a5539d5ba63d5829815e414294a0076befdb5ae34

SHA512
21c30060bca8e01b1a2108d72fc10adea351b2ec7cb53664501c58683d51324a16fc5c96a5937a85e1e8e5ddfe8012e2878413228dc1fb697f1c045c151458ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93fb203c4099e55fd7779832f19be2fb

SHA1
ebd849c56e4159c5d6bb706a7c1371b0145322ec

SHA256
2d1776b1f6ef9d6e20f2ca1f392f6d2348330e43a50a0230b106ff92ff8b816c

SHA512
ef44aae7c5b235d41d60e682c11a8a978c8209528c637c4bf696b625993f79499475ebb6e5c36654a110c11c7a7f6d303fbf7a7b5e1c934f8f4b7d4e0b719009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e455c958de3736480b6910ce1a75a10a

SHA1
8e5407a00b82bc5e5e0580d6c2fa976277440658

SHA256
7defe77e60ddc52e730891420e139ff5b3b7be93d2f73b5af7ce1b29f04ef3b7

SHA512
7f6cf038a315bf65937c5ba8f76988029883ccdfc5fc615e60620ffada863bb4744deab1ec78a9825a1ea2a3f5537f615d3cf38e89f46445e7567136abfa349f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b91f50aee26ac7310898b67e3fb8faf

SHA1
5d8738e5f795d6655cf6b9fc50d1afca3025482e

SHA256
441a8862fd44854c457af40721a67644b10d41468d6b675b3ebc8bcbff674787

SHA512
5bdb3d0950bc35ae11905a4b21d02492df594f5b7da51066818ccb61dd63e32fdd89616a0193a793185aa4b49b64583469ce3651840e9fde2d0666f7afa92b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7f928da533b2b3118c76a66103d38c7

SHA1
0dba7e74c9e65b2e0e27d98f1ca036334dd4cf1e

SHA256
2a785921311b03ea9f96b6d3f87d0082d392d4ad2cb5af4c5c84d16e051eb658

SHA512
c5b918e4622c67457aeb40a3a9b63e299ab9126b64f030ad890d4963a228bf3e9af9227b99ab9a44f145c48ecf9f0681043b0a21401d458566193cca53e87e43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c43e84dab8199c07cdaac91950da32da

SHA1
f2c7c6763d398fb4b90e7fca4546a93ce267c465

SHA256
81a497b2853e3b889f4ad1c4a27d6c0cc76b4cd1a7536d46b09afd950952c153

SHA512
739e3721987ed81cffe9e4879c3152644cf3cc9debcb014a039b9c85a064c08038ddb193f070e2bef3b9f49aeee88c7b960ed9b9b25ba3af75de9781b51d61e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FED94E11-C98B-11EF-A97E-EE9D5ADBD8E3}.dat

Filesize
3KB

MD5
e885515f0b1f9ed217c7dd4870581be0

SHA1
4253bcf516f91c6e3f19010ad4846951719bc008

SHA256
270582ad4b35639e56f64cbbfaa0971a8a70012ac56e82c4f999fa27e59bded2

SHA512
7c2e82a119c62d27a62de5f5516113cea5244044c9f0c553681cc2db68f133893138f89f0805c90063ccf48aa900ba9f3bb7746f8b2ffb82e14d055387e01b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FEDB8861-C98B-11EF-A97E-EE9D5ADBD8E3}.dat

Filesize
5KB

MD5
494b312bc311f54dc3e55535b7ee227e

SHA1
1d796a79896e05357d66d4217d992af5a2900672

SHA256
41cdb3590787f6bb1fcb1baacefc5cf27bd78f7668e727327098a53de1da5178

SHA512
12e450310d59e91caebfaa2dfb1d510ca73895367f464256469a27af6ac6609bdbceb1f19d7a6f864b4aaef1b80e2f0a07f2ecd20de7c994d58b97f1e3011bd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC93.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD63.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
111KB

MD5
0807f983542add1cd3540a715835595e

SHA1
f7e1bca5b50ab319e5bfc070a3648d2facb940eb

SHA256
8b492fd5118993f8adb4ddbba5371a827fa96ff69699fe82286ad3a92758bf5f

SHA512
27161f765072f32977bfae3737a804492251514bd256336ed9eee985a760f11c8c778bfb45760bdbf94cb69ed49fa6831f2700548a290412a577fbc70a5b7d77

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1640-6-0x0000000010000000-0x0000000010406000-memory.dmp

Filesize
4.0MB

Download
memory/1640-14-0x0000000010000000-0x0000000010406000-memory.dmp

Filesize
4.0MB

Download
memory/1640-32-0x0000000010000000-0x0000000010406000-memory.dmp

Filesize
4.0MB

Download
memory/2232-35-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2232-38-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2404-21-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2404-26-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2584-29-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2584-31-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2972-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download