Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 21:20
Static task
static1
Behavioral task
behavioral1
Sample
ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe
Resource
win10v2004-20220812-en
General
-
Target
ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe
-
Size
132KB
-
MD5
916bf9f1fc6f0eb72bc2103d86b770a0
-
SHA1
968424f77d62cccb21deb07fbebb7e7cd81d348c
-
SHA256
ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed
-
SHA512
b95d636b9d74b6353387363719417a9b4d1dab3a2f6db2d539001f9f8438422506bd48bf7cedc0a042a05adb2a6e224ff444415f9b0bd2ac700bfe9097e49058
-
SSDEEP
768:KL/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgT+:KL/roM7ZJfUQWgY54v
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msng.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe -
Executes dropped EXE 1 IoCs
pid Process 2028 msng.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe" ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe" msng.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: msng.exe File opened (read-only) \??\b: msng.exe File opened (read-only) \??\e: msng.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32.exe ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe File created C:\Windows\SysWOW64\rundII32.exe msng.exe File opened for modification C:\Windows\SysWOW64\rundII32.exe msng.exe File created C:\Windows\SysWOW64\rundll32.exe msng.exe File created C:\Windows\SysWOW64\msng.exe ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe File opened for modification C:\Windows\SysWOW64\msng.exe ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe File created C:\Windows\SysWOW64\rundII32.exe ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\80d5cfe9-4838-4e7f-9ac0-f3a77f622032.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221020035700.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe -
Modifies registry class 37 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000005455021f100054656d7000003a0009000400efbe0c55199954550c1f2e00000096e10100000001000000000000000000000000000000c32d2100540065006d007000000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000000c5519991100557365727300640009000400efbe874f77485455001f2e000000c70500000000010000000000000000003a00000000008714af0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000000f55626510004c6f63616c003c0009000400efbe0c5519995455001f2e00000095e1010000000100000000000000000000000000000004c32c014c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = ca003100000000005455021f10004546374534397e310000b20009000400efbe5455021f5455021f2e000000292e0200000009000000000000000000000000000000c32d21006500660037006500340039003000360066003900330063003000300065003200300038003200310037003500620038003800340039006600340036006300380063006100640066006400630035003500310035006100330035006500330039003000360032003800360035006500390037003700320031003000350065006400000018000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000000c555b9f100041646d696e003c0009000400efbe0c5519995455001f2e00000077e10100000001000000000000000000000000000000f3e2f000410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000000c55199912004170704461746100400009000400efbe0c5519995455001f2e00000082e10100000001000000000000000000000000000000bc3d97004100700070004400610074006100000016000000 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 3136 msedge.exe 3136 msedge.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 3468 msedge.exe 3468 msedge.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe 2028 msng.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2028 msng.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5076 ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe 2028 msng.exe 2200 explorer.exe 2200 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 3644 5076 ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe 84 PID 5076 wrote to memory of 3644 5076 ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe 84 PID 5076 wrote to memory of 3644 5076 ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe 84 PID 5076 wrote to memory of 2028 5076 ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe 85 PID 5076 wrote to memory of 2028 5076 ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe 85 PID 5076 wrote to memory of 2028 5076 ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe 85 PID 2028 wrote to memory of 1048 2028 msng.exe 87 PID 2028 wrote to memory of 1048 2028 msng.exe 87 PID 2028 wrote to memory of 1048 2028 msng.exe 87 PID 176 wrote to memory of 3468 176 explorer.exe 89 PID 176 wrote to memory of 3468 176 explorer.exe 89 PID 3468 wrote to memory of 4120 3468 msedge.exe 91 PID 3468 wrote to memory of 4120 3468 msedge.exe 91 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 932 3468 msedge.exe 96 PID 3468 wrote to memory of 3136 3468 msedge.exe 97 PID 3468 wrote to memory of 3136 3468 msedge.exe 97 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98 PID 3468 wrote to memory of 1836 3468 msedge.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe"C:\Users\Admin\AppData\Local\Temp\ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed2⤵PID:3644
-
-
C:\Windows\SysWOW64\msng.exe"C:\Windows\system32\msng.exe" fuckystart2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.OpenClose.ir3⤵PID:1048
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2200
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:176 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.openclose.ir/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf3be46f8,0x7ffdf3be4708,0x7ffdf3be47183⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:23⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:83⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:13⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:13⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 /prefetch:83⤵PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:13⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:13⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5452 /prefetch:83⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:13⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:13⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:13⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:83⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:3032 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7e5795460,0x7ff7e5795470,0x7ff7e57954804⤵PID:2248
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:83⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:13⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5080 /prefetch:83⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:13⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3176566003947139061,8759935835676024394,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:23⤵PID:5072
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5916bf9f1fc6f0eb72bc2103d86b770a0
SHA1968424f77d62cccb21deb07fbebb7e7cd81d348c
SHA256ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed
SHA512b95d636b9d74b6353387363719417a9b4d1dab3a2f6db2d539001f9f8438422506bd48bf7cedc0a042a05adb2a6e224ff444415f9b0bd2ac700bfe9097e49058
-
Filesize
132KB
MD5916bf9f1fc6f0eb72bc2103d86b770a0
SHA1968424f77d62cccb21deb07fbebb7e7cd81d348c
SHA256ef7e4906f93c00e2082175b8849f46c8cadfdc5515a35e39062865e9772105ed
SHA512b95d636b9d74b6353387363719417a9b4d1dab3a2f6db2d539001f9f8438422506bd48bf7cedc0a042a05adb2a6e224ff444415f9b0bd2ac700bfe9097e49058
-
Filesize
100B
MD5dc932370f8304f8ba1a7705693e3f05e
SHA14fd01e4eb547bd6ca281061f5e0e9834a098aa0f
SHA256ad29ff1c13d7f6eac8d36391dc5aac869826d6cc0f83374f12f892829494b344
SHA5129ee92d79900b2bd5d1bce83a8343330bebcfdc6299f31e5c49892cf5dcfdffb90b645808a6fea862c0f5a31449fd62b21e3e515b5c614012517942d499218ed5