dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910

General

Target

dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
Size

3.7MB
MD5

dcab6a3b553a1bce6c3202ba1d5b60bb
SHA1

89c7c300b75e288247dc767748934beacf44c62e
SHA256

dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910
SHA512

0143699c3600484dcce96d056c7bf6891e6fd9e8cc7e0a88aee350b49e257fbb7cae2028174ce1e2cf5f10bf8fed870101db5c745b670a8716a397e2c988489d

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
Executes dropped EXE 1 IoCs

Processes:

msng.exe

pid process

2008 msng.exe

Loads dropped DLL 2 IoCs

Processes:

dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe

pid	process
1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msng.exedcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

msng.exe

description ioc process

File opened (read-only) \??\a: msng.exe
File opened (read-only) \??\b: msng.exe
File opened (read-only) \??\e: msng.exe

description	ioc	process
File opened (read-only)	\??\a:	msng.exe
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe

Drops file in System32 directory 7 IoCs

Processes:

msng.exedcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
File created	C:\Windows\SysWOW64\rundII32.exe	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
File created	C:\Windows\SysWOW64\rundll32.exe	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeexplorer.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DC99C41-D89C-11EC-BD51-FABB0CD78C51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359857560"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c0000000002000000000010660000000100002000000054d854312e36a09d0d539c5a0deb96c613deab6f70da47ae5868f8d07ab5363d000000000e80000000020000200000005d61f44b964d78fe2b781f552a8ea650b9eacb157a867b145db99a26231ae736200000002742b356ffb45e0c9c128648ec171a152464ee5b71e4d453e87e45ee887d857440000000a81ed44ea95392fde026d2bd33149bf10a641623d63f5e634a389d64eae53ddbc613c7182650788b82c98236863ceb2c9c6bd9d8a3121398f8e96da82d5d6d38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8078c10fa96cd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c00000000020000000000106600000001000020000000ba1686b5c65fadd4e24ef4ed032acd340ac6294bfa07f870a66b739796c4ec5b000000000e800000000200002000000072343b09da9b4858122f3eba2b75d8b000356a1cb3c3a02b2e9f9d43526d9cf09000000077959f1f9f48a84e38394fc5d58fd1f2a67c69a65215d8d208145b548e42d5e1118f744b0a2e0200fbfea8b2ff918d7b84f47f5d8f22fabeb1edaa7ea0056bd97203b0c5e3e0140d14b8da0f1f58457363415767644316a61002491f375a96c6c7c9e19fec1dc08d0e79f3340fec6212cfdad8c3244dc2a776a5e13a799402db6e4cd39191353a82352f8a8172bd2e0940000000f74176cfcab23d7e846f8f7110c2060e5e47e805cb6cf8b35b4f1b96c4ea89a9e2d3eb82cc4a8b522fa0efce9595dd049ac3e3b0364b322c6f323bdd2dce68d2	iexplore.exe

Modifies registry class 37 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000008e5462b3100041646d696e00380008000400efbe8e541ca08e5462b32a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000008e541ca0122041707044617461003c0008000400efbe8e541ca08e541ca02a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000008e541ca01100557365727300600008000400efbeee3a851a8e541ca02a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000008e546ba210204c6f63616c00380008000400efbe8e541ca08e546ba22a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000b554e002102054656d700000360008000400efbe8e541ca0b554e0022a00000001020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = c600310000000000b554e00210204443463032327e310000ae0008000400efbeb554e002b554e0022a000000ef32010000000a0000000000000000000000000000006400630066003000320032006300380033006400640033003000390030006100620039003300640033003300310066006100640062003400630031003400350062006500640033003300320033006100620061003100650031003000650036003800630061006600300039003600390062003200340063003500390031003000000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msng.exe

pid	process
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe
2008	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msng.exe

pid process

2008 msng.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1004 iexplore.exe

pid	process
1004	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exemsng.exeiexplore.exeIEXPLORE.EXE

pid	process
1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
2008	msng.exe
1004	iexplore.exe
1004	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exemsng.exeexplorer.exeiexplore.exe

description	pid	process	target process
PID 1528 wrote to memory of 1996	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	explorer.exe
PID 1528 wrote to memory of 1996	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	explorer.exe
PID 1528 wrote to memory of 1996	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	explorer.exe
PID 1528 wrote to memory of 1996	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	explorer.exe
PID 1528 wrote to memory of 2008	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	msng.exe
PID 1528 wrote to memory of 2008	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	msng.exe
PID 1528 wrote to memory of 2008	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	msng.exe
PID 1528 wrote to memory of 2008	1528	dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe	msng.exe
PID 2008 wrote to memory of 2004	2008	msng.exe	explorer.exe
PID 2008 wrote to memory of 2004	2008	msng.exe	explorer.exe
PID 2008 wrote to memory of 2004	2008	msng.exe	explorer.exe
PID 2008 wrote to memory of 2004	2008	msng.exe	explorer.exe
PID 1776 wrote to memory of 1004	1776	explorer.exe	iexplore.exe
PID 1776 wrote to memory of 1004	1776	explorer.exe	iexplore.exe
PID 1776 wrote to memory of 1004	1776	explorer.exe	iexplore.exe
PID 1004 wrote to memory of 1780	1004	iexplore.exe	IEXPLORE.EXE
PID 1004 wrote to memory of 1780	1004	iexplore.exe	IEXPLORE.EXE
PID 1004 wrote to memory of 1780	1004	iexplore.exe	IEXPLORE.EXE
PID 1004 wrote to memory of 1780	1004	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe
"C:\Users\Admin\AppData\Local\Temp\dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910
2⤵
PID:1996

C:\Windows\SysWOW64\msng.exe
"C:\Windows\system32\msng.exe" fuckystart
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\explorer.exe
explorer.exe http://www.OpenClose.ir
3⤵
PID:2004

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1004 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7930V9JE.txt
Filesize
603B

MD5
6fbba744cb44f366ae3524ad4d3f40d8

SHA1
74717607ed419c31a01eaf5ace055381b4209924

SHA256
af80c66430543b6a5fc3cac2670abf5efced90761d557ec99293dd3158ec8f2d

SHA512
31301d7d2dcd8e46e305420ad57eb6281eff01a9499cc08bd6cdfe20bd6202103d193d89add0869554162d1d19939e554d46854b0759f4dffed9d6c7c3c729c3

Download Submit
C:\Windows\SysWOW64\msng.exe
Filesize
3.7MB

MD5
dcab6a3b553a1bce6c3202ba1d5b60bb

SHA1
89c7c300b75e288247dc767748934beacf44c62e

SHA256
dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910

SHA512
0143699c3600484dcce96d056c7bf6891e6fd9e8cc7e0a88aee350b49e257fbb7cae2028174ce1e2cf5f10bf8fed870101db5c745b670a8716a397e2c988489d

Download Submit
C:\Windows\SysWOW64\msng.exe
Filesize
3.7MB

MD5
dcab6a3b553a1bce6c3202ba1d5b60bb

SHA1
89c7c300b75e288247dc767748934beacf44c62e

SHA256
dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910

SHA512
0143699c3600484dcce96d056c7bf6891e6fd9e8cc7e0a88aee350b49e257fbb7cae2028174ce1e2cf5f10bf8fed870101db5c745b670a8716a397e2c988489d

Download Submit
C:\~0002ftd.tmp
Filesize
100B

MD5
62bc1d702b4a69f188b417bb1dcbd11b

SHA1
6ab82d05924aeff05d00cd54bf152276875195b3

SHA256
7187fd637a29523b57e83824c2de1fbce670abe5c38f620da681acd177076887

SHA512
e0c814701a6f1b43820154bed493ddefd804bfbcd64469e86a2ae7d1bcdb2cae2192e1a355045791dec2397e62f8d24fecf42c71b67eda5fc2b728291be8ccf8

Download Submit
\Windows\SysWOW64\msng.exe
Filesize
3.7MB

MD5
dcab6a3b553a1bce6c3202ba1d5b60bb

SHA1
89c7c300b75e288247dc767748934beacf44c62e

SHA256
dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910

SHA512
0143699c3600484dcce96d056c7bf6891e6fd9e8cc7e0a88aee350b49e257fbb7cae2028174ce1e2cf5f10bf8fed870101db5c745b670a8716a397e2c988489d

Download Submit
\Windows\SysWOW64\msng.exe
Filesize
3.7MB

MD5
dcab6a3b553a1bce6c3202ba1d5b60bb

SHA1
89c7c300b75e288247dc767748934beacf44c62e

SHA256
dcf022c83dd3090ab93d331fadb4c145bed3323aba1e10e68caf0969b24c5910

SHA512
0143699c3600484dcce96d056c7bf6891e6fd9e8cc7e0a88aee350b49e257fbb7cae2028174ce1e2cf5f10bf8fed870101db5c745b670a8716a397e2c988489d

Download Submit
memory/956-68-0x00000000039C0000-0x00000000039D0000-memory.dmp

Filesize
64KB

Download
memory/956-67-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1996-63-0x0000000074591000-0x0000000074593000-memory.dmp

Filesize
8KB

Download
memory/1996-57-0x0000000000000000-mapping.dmp

Download
memory/2004-71-0x0000000000000000-mapping.dmp

Download
memory/2004-73-0x00000000747B1000-0x00000000747B3000-memory.dmp

Filesize
8KB

Download
memory/2008-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads