Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe
-
Size
136KB
-
MD5
eb7906c1b79d9808b8b2fd425ee3e36a
-
SHA1
98aa3c018a6341f30e42b54e577fd7388fc11a8a
-
SHA256
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
-
SHA512
63c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3
-
SSDEEP
768:h/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgTA1:h/roM7ZJfUQWgY54v
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msng.exe -
Executes dropped EXE 1 IoCs
pid Process 608 msng.exe -
Loads dropped DLL 2 IoCs
pid Process 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe" b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run msng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe" msng.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: msng.exe File opened (read-only) \??\b: msng.exe File opened (read-only) \??\e: msng.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundII32.exe msng.exe File opened for modification C:\Windows\SysWOW64\rundII32.exe msng.exe File created C:\Windows\SysWOW64\rundll32.exe msng.exe File created C:\Windows\SysWOW64\msng.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe File opened for modification C:\Windows\SysWOW64\msng.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe File created C:\Windows\SysWOW64\rundII32.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe File created C:\Windows\SysWOW64\rundll32.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376888441" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e5f78200ea85814cb88a363d40807bd600000000020000000000106600000001000020000000e6bcc8976575fa03ab06fb8b09dd059378dc3fa800ed2818f2cdbea6e81b7f91000000000e80000000020000200000008b4a10257867a79ebc2a6de1faf70bf07a72292898c3ac38ce133273275ff2f3200000009b843b07e7dae7a8e24a67211d8ec4366b6e8d36d47119deab40b96105d6983040000000b4271b4f2c20965d682a7bfe390ff9cdca21f258d22883bdcad0d409d06a319f9ca564830a5ef03c15d17e385530360cdac451da34d35a441f41ddcef5afdce8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f003633d8e07d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47D164D1-7381-11ED-9551-6E705F4A26E5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e5f78200ea85814cb88a363d40807bd600000000020000000000106600000001000020000000f7ae6048a5a2142a06501aa0c47d71a95e5dbda57d90b9f8397c81e9d8c30d4f000000000e8000000002000020000000d1d2c2b81074a5e64cd4ee4e19e0d72e5c13885038b054881f9b1c1a9ff7ab6990000000436747a898ed002023fc6bf0dee2ae3d393bc55d09fd0203ce07690e0a641f689fe76675f872167bf2307d4aba5236dd0c5d0f74552203444427ddc41b64594fab012692c7263bfdc4facaef6b6e1e79794e9341ed25e0d712a57582fc602372329d4b23b9cc6cc5fab6a7ac4eaa222d604217ff3239143d64ee98ba4afec113c1360edb89acb6e439ee6a7be65b1d06400000000d4b37e109d50e22fe68a977fc7b15999068e84aa24c833001b2446cc30b402103912af45fc44fe6f0e8f77b29129071d898e5047fb921c2e10b31a6852607cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Modifies registry class 37 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000000c559a7a100041646d696e00380008000400efbe0c55cb700c559a7a2a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = c60031000000000084555d1910204230313230397e310000ae0008000400efbe84555d1984555d192a0000001523010000000c0000000000000000000000000000006200300031003200300039006100390039006400340038003300300061006600330037003500360066006600330037003900390066006500650037003500340061006200370035006600300035006100320037003500620063006100340032006200320037006500610066006500320034003600660036006300350032003100000018000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000000c55ed7210204c6f63616c00380008000400efbe0c55cb700c55ed722a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000084555d19102054656d700000360008000400efbe0c55cb7084555d192a000000ff010000000002000000000000000000000000000000540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000000c55cb701100557365727300600008000400efbeee3a851a0c55cb702a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000000c55cb70122041707044617461003c0008000400efbe0c55cb700c55cb702a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000 explorer.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe 608 msng.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 608 msng.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1892 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 608 msng.exe 1892 iexplore.exe 1892 iexplore.exe 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 964 wrote to memory of 1340 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 28 PID 964 wrote to memory of 1340 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 28 PID 964 wrote to memory of 1340 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 28 PID 964 wrote to memory of 1340 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 28 PID 964 wrote to memory of 608 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 29 PID 964 wrote to memory of 608 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 29 PID 964 wrote to memory of 608 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 29 PID 964 wrote to memory of 608 964 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 29 PID 608 wrote to memory of 1568 608 msng.exe 31 PID 608 wrote to memory of 1568 608 msng.exe 31 PID 608 wrote to memory of 1568 608 msng.exe 31 PID 608 wrote to memory of 1568 608 msng.exe 31 PID 808 wrote to memory of 1892 808 explorer.exe 33 PID 808 wrote to memory of 1892 808 explorer.exe 33 PID 808 wrote to memory of 1892 808 explorer.exe 33 PID 1892 wrote to memory of 1972 1892 iexplore.exe 35 PID 1892 wrote to memory of 1972 1892 iexplore.exe 35 PID 1892 wrote to memory of 1972 1892 iexplore.exe 35 PID 1892 wrote to memory of 1972 1892 iexplore.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe"C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c5212⤵PID:1340
-
-
C:\Windows\SysWOW64\msng.exe"C:\Windows\system32\msng.exe" fuckystart2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.OpenClose.ir3⤵PID:1568
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1172
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535B
MD5946c2a5be8e86540cd9ffd04e71021e7
SHA16e915c94a24206ce646aef526adf4372e062d764
SHA256ad515fba42afb9d509790226a9f5cc03d685657d5befc14aba47fe1428073693
SHA512915a6fe0cca5bc78c3407c26919b3d1aec7930030e0e2ac9c26598e166507c419670f42dbc4838190724f8e00b16c0eeb7519c4700223af59d8cf7a59cd150c2
-
Filesize
136KB
MD5eb7906c1b79d9808b8b2fd425ee3e36a
SHA198aa3c018a6341f30e42b54e577fd7388fc11a8a
SHA256b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
SHA51263c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3
-
Filesize
136KB
MD5eb7906c1b79d9808b8b2fd425ee3e36a
SHA198aa3c018a6341f30e42b54e577fd7388fc11a8a
SHA256b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
SHA51263c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3
-
Filesize
100B
MD586149294c30f48d736a47cfe9f86499c
SHA18bf7fa89c1a028b978110c8bd69301a1af0cdc1b
SHA2567e13a885b9e34e5c304fc7623b35355ad1e7ccf2968fcd9c5250e73e30118f19
SHA512e88ac89bab38557b54288f5d4e208a55fdd6f3912841ce5f2ecf5e2082019450deb6f7101d9ea33b8b8153df38d7396087bb5a1e56c11ab65f0ab538a823874c
-
Filesize
136KB
MD5eb7906c1b79d9808b8b2fd425ee3e36a
SHA198aa3c018a6341f30e42b54e577fd7388fc11a8a
SHA256b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
SHA51263c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3
-
Filesize
136KB
MD5eb7906c1b79d9808b8b2fd425ee3e36a
SHA198aa3c018a6341f30e42b54e577fd7388fc11a8a
SHA256b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
SHA51263c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3