Analysis
-
max time kernel
166s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 19:25
Static task
static1
Behavioral task
behavioral1
Sample
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe
Resource
win10v2004-20221111-en
General
-
Target
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe
-
Size
136KB
-
MD5
eb7906c1b79d9808b8b2fd425ee3e36a
-
SHA1
98aa3c018a6341f30e42b54e577fd7388fc11a8a
-
SHA256
b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
-
SHA512
63c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3
-
SSDEEP
768:h/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgTA1:h/roM7ZJfUQWgY54v
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" msng.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe -
Executes dropped EXE 1 IoCs
pid Process 5036 msng.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe" b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe" msng.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: msng.exe File opened (read-only) \??\b: msng.exe File opened (read-only) \??\e: msng.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32.exe msng.exe File created C:\Windows\SysWOW64\msng.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe File opened for modification C:\Windows\SysWOW64\msng.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe File created C:\Windows\SysWOW64\rundII32.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe File created C:\Windows\SysWOW64\rundll32.exe b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe File created C:\Windows\SysWOW64\rundII32.exe msng.exe File opened for modification C:\Windows\SysWOW64\rundII32.exe msng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 37 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000006b556b6e10004c6f63616c003c0009000400efbe6b55586c84554c192e00000077e10100000001000000000000000000000000000000d636dd004c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000006b55586c1100557365727300640009000400efbe874f774884554c192e000000c70500000000010000000000000000003a0000000000119b830055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e0031000000000084554c19100054656d7000003a0009000400efbe6b55586c84554d192e00000078e10100000001000000000000000000000000000000aacc5d00540065006d007000000014000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000006b55586c12004170704461746100400009000400efbe6b55586c84554c192e00000064e10100000001000000000000000000000000000000f9256e004100700070004400610074006100000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000006b55fd72100041646d696e003c0009000400efbe6b55586c84554c192e00000059e101000000010000000000000000000000000000009b1f6400410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = ca0031000000000084554c1910004230313230397e310000b20009000400efbe84554c1984554c192e00000073310200000007000000000000000000000000000000aacc5d006200300031003200300039006100390039006400340038003300300061006600330037003500360066006600330037003900390066006500650037003500340061006200370035006600300035006100320037003500620063006100340032006200320037006500610066006500320034003600660036006300350032003100000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe 5036 msng.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5036 msng.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 764 msedge.exe 764 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 764 msedge.exe 764 msedge.exe 764 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4428 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 5036 msng.exe 4852 explorer.exe 4852 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 1912 4428 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 82 PID 4428 wrote to memory of 1912 4428 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 82 PID 4428 wrote to memory of 1912 4428 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 82 PID 4428 wrote to memory of 5036 4428 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 83 PID 4428 wrote to memory of 5036 4428 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 83 PID 4428 wrote to memory of 5036 4428 b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe 83 PID 5036 wrote to memory of 216 5036 msng.exe 85 PID 5036 wrote to memory of 216 5036 msng.exe 85 PID 5036 wrote to memory of 216 5036 msng.exe 85 PID 4260 wrote to memory of 764 4260 explorer.exe 87 PID 4260 wrote to memory of 764 4260 explorer.exe 87 PID 764 wrote to memory of 744 764 msedge.exe 91 PID 764 wrote to memory of 744 764 msedge.exe 91 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1440 764 msedge.exe 94 PID 764 wrote to memory of 1188 764 msedge.exe 95 PID 764 wrote to memory of 1188 764 msedge.exe 95 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96 PID 764 wrote to memory of 3736 764 msedge.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe"C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c5212⤵PID:1912
-
-
C:\Windows\SysWOW64\msng.exe"C:\Windows\system32\msng.exe" fuckystart2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.OpenClose.ir3⤵PID:216
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4852
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.openclose.ir/2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82f5946f8,0x7ff82f594708,0x7ff82f5947183⤵PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵PID:1440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:33⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:83⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:13⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:13⤵PID:976
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5eb7906c1b79d9808b8b2fd425ee3e36a
SHA198aa3c018a6341f30e42b54e577fd7388fc11a8a
SHA256b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
SHA51263c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3
-
Filesize
136KB
MD5eb7906c1b79d9808b8b2fd425ee3e36a
SHA198aa3c018a6341f30e42b54e577fd7388fc11a8a
SHA256b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
SHA51263c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3
-
Filesize
100B
MD586149294c30f48d736a47cfe9f86499c
SHA18bf7fa89c1a028b978110c8bd69301a1af0cdc1b
SHA2567e13a885b9e34e5c304fc7623b35355ad1e7ccf2968fcd9c5250e73e30118f19
SHA512e88ac89bab38557b54288f5d4e208a55fdd6f3912841ce5f2ecf5e2082019450deb6f7101d9ea33b8b8153df38d7396087bb5a1e56c11ab65f0ab538a823874c