5436bf05d6c0d951519d68a8ab41e15ef54141699ecd4a7330b9d8c158cfa0c2

Analysis

max time kernel
120s
max time network
69s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ae9da583019975a83b03ddcd722ebb0N.exe
Size

3.7MB
MD5

0ae9da583019975a83b03ddcd722ebb0
SHA1

b423cd8b885527b815410bfbaaa1ed4ec1257572
SHA256

5436bf05d6c0d951519d68a8ab41e15ef54141699ecd4a7330b9d8c158cfa0c2
SHA512

537c01cf17eba8c1b94ffb8bee5df1c5e7927e4f8dc68311d37c8d400450b9a3cd2cbd4495f4c27ccc5eca8c066c3a5c95404e902a27fdaf4f373f6873061fd4
SSDEEP

24576:Qfs6Ds6e+JmLkMQaejgLAKWNV96IO4t0drSvc7:Qfs6Ds6rmLbQa3AKWRhtuo

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0ae9da583019975a83b03ddcd722ebb0N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe

Executes dropped EXE 1 IoCs

pid	Process
1640	msng.exe

Loads dropped DLL 2 IoCs

pid	Process
1596	0ae9da583019975a83b03ddcd722ebb0N.exe
1596	0ae9da583019975a83b03ddcd722ebb0N.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	0ae9da583019975a83b03ddcd722ebb0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	msng.exe
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	0ae9da583019975a83b03ddcd722ebb0N.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	0ae9da583019975a83b03ddcd722ebb0N.exe
File created	C:\Windows\SysWOW64\rundII32.exe	0ae9da583019975a83b03ddcd722ebb0N.exe
File created	C:\Windows\SysWOW64\rundll32.exe	0ae9da583019975a83b03ddcd722ebb0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ae9da583019975a83b03ddcd722ebb0N.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429804620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507c7e724feeda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{978722E1-5A42-11EF-A446-DA486F9A72E4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000000d642de0d9a4f8e09d9ff3669fb25be2345d3db446364743f97885d3d339ba4f000000000e80000000020000200000000c807d9e8f75a941b345c69260abb54f4ce18398f8f9c3edc7b48ab99621571c90000000882ac2742a910f4a80e5783ac86568bf3fe43b03793c696b1e8918d6813bdd1a99c0d2b69346504df38a17c85231d5533ce371de59570930375a913111bc247261d3d9bf66ba7c95d69a5b12759908d05f2d838af9482cba25f3012296a286be2ab01bf1061cddd22fac1d7ffcd52de0570dfddd9a9c38e45a915c0fe9a8bbe0a7b100caabe3cb68f2ae9d3af2a0d4064000000005e64772f21390b6c7829b456a75058468eba251692f5eb77ed57646c2aca86e217cfeadd2736e91a54db9ea8bfb9af43a4bd981d9a451c2d8a2fdd66f22066d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007fb85f08eeddfdc02bbbb914568d460782fa37dee8d136d4d543b99555fb8336000000000e8000000002000020000000766aea7cb9357b2dfd1c37be0d1372d85d70b0411b6108e4ecc066c1d28c66d72000000060e8f88b5704be945aa982a550c7605a2f03bfd2a21237be9ed0502d27c46381400000005c66b647d16d29328a1516ed4d0578c9a9518c9955a36753d3eaed0098d451f936dc129d83c637f8b26861f13e426cd0dd0847e497c2f65bc67756b5cc007a12	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 88003100000000000e59e76c10203041453944417e310000700008000400efbe0e59e76c0e59e76c2a000000a35f0100000008000000000000000000000000000000300061006500390064006100350038003300300031003900390037003500610038003300620030003300640064006300640037003200320065006200620030004e00000018000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000e55873491100557365727300600008000400efbeee3a851ae55873492a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000e558984a10204c6f63616c00380008000400efbee5587349e558984a2a000000050200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a003100000000000e59e76c102054656d700000360008000400efbee55873490e59e76c2a00000006020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000e5587349122041707044617461003c0008000400efbee5587349e55873492a000000f20100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000e558b24d100041646d696e00380008000400efbee5587349e558b24d2a000000e7010000000003000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe
1640	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	msng.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1596	0ae9da583019975a83b03ddcd722ebb0N.exe
1640	msng.exe
2772	iexplore.exe
2772	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 352	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	30
PID 1596 wrote to memory of 352	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	30
PID 1596 wrote to memory of 352	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	30
PID 1596 wrote to memory of 352	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	30
PID 1596 wrote to memory of 1640	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	31
PID 1596 wrote to memory of 1640	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	31
PID 1596 wrote to memory of 1640	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	31
PID 1596 wrote to memory of 1640	1596	0ae9da583019975a83b03ddcd722ebb0N.exe	31
PID 1640 wrote to memory of 2800	1640	msng.exe	34
PID 1640 wrote to memory of 2800	1640	msng.exe	34
PID 1640 wrote to memory of 2800	1640	msng.exe	34
PID 1640 wrote to memory of 2800	1640	msng.exe	34
PID 2284 wrote to memory of 2772	2284	explorer.exe	36
PID 2284 wrote to memory of 2772	2284	explorer.exe	36
PID 2284 wrote to memory of 2772	2284	explorer.exe	36
PID 2772 wrote to memory of 2700	2772	iexplore.exe	37
PID 2772 wrote to memory of 2700	2772	iexplore.exe	37
PID 2772 wrote to memory of 2700	2772	iexplore.exe	37
PID 2772 wrote to memory of 2700	2772	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\0ae9da583019975a83b03ddcd722ebb0N.exe
"C:\Users\Admin\AppData\Local\Temp\0ae9da583019975a83b03ddcd722ebb0N.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\0ae9da583019975a83b03ddcd722ebb0N
  2⤵
  - System Location Discovery: System Language Discovery
  PID:352
- C:\Windows\SysWOW64\msng.exe
  "C:\Windows\system32\msng.exe" fuckystart
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe http://www.OpenClose.ir
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac39c19fa0ea709769a94e08ee80e848

SHA1
ff49d94dcd787f07a036b38d1dc9228451a63824

SHA256
2cb52dfb088f56abbeaa4d7ad3626f205ebce2229726077784052331d9c9842b

SHA512
61b71ee4924ecac83898f4326ee19795a14adf9dbe7dc359d6279602e8720fde66488afc07e03a6fbef553e4235f332109a222cd594fe42da92f5e7bf533a2a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8f5601448c16c14cee419f7bdf14599

SHA1
527088c48baaed7728c69604e0cbebae0a39c54f

SHA256
7f141434dd5ecd3a0d26a95b1e0864faab425026f60fd5920bcf0a59421b8edf

SHA512
1d59f295dfdab3dfd5cab89b0eed1a8862d5842473315df2200139971e59d1a01f0e925731c437b7c10915cdcaa568c6e8f1c81e1f5a286cf9e5b1950fcdc41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a39cb82b8adfdb18e462bf7ed0e73540

SHA1
8b0985854abbd7ca7344cb0fd58d7ba0ca7d2e34

SHA256
9d5322a97dc9055edd9267255fcb258cff809304e55758d8806367b57a6a050b

SHA512
4b753aeff8493f329920eb138884f9bbe2f745fddaf34e351b35c7ae75f095dcb9b581a7225d216f3b066abef3ba5f48fc0d4d1879f1fe09c61dd1f64bfca7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9138fb072d9c2ab2b89391ead744cf29

SHA1
156ab7dc7a1be7b697301fbcb5a93b9faebf44fb

SHA256
efa4b9c846d97bf53633faf49e203e9f9ed504ca07956c322abda24aaa011a69

SHA512
8fb87bd7860ae1eef00d4de76323bf5178a1a09d6e3c7c609b4ee0c3e4667cd36276332907140775d0db297ed2a41651a1860cade91e7e88eb0a07bcd9524817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bd68d9a5fd63a40a642fecba6016510

SHA1
7dc3d5246952e4ac5b7163572bc0ef1585a1a18a

SHA256
9f9f44d77144d66675a254828689b417a8fcae0791a16f1a616a60e7cd41ff5c

SHA512
2caab7f9deace3b60e999360bfb64727c18130c2dff7f7c0d2f56ffa72b16bdc07b2b3537d680e7f7a7da9d770e4cf4d0057ade3ce3d5bf81cc4d3bfcfe9de74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c78c3b2d63b0a9a93d3dbcd82335c428

SHA1
997a0ade275178d47f44aa4cb773c1775bba8375

SHA256
c5eace2629cbb921fa1717b592db9df654818500e63c50f4198fc43cba0a515a

SHA512
d60992149383c0be2944d74e00870c4cd4dc6d2f6b71f62ece6ee4d0e6fc29d5912298a7e9448f5c51d01244c97a0df3d9a6c9b003b3c393e35aae7c6469cd55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94a0b6389a34e8a7500fa416f6ace54b

SHA1
6dc32801b5341e398a17f1891f392bc9b89c8abb

SHA256
b2cc0b63c823dd63c52e91a251f5ddc507e2d35f048541e0ba75e034d5746f0a

SHA512
3f9ca193c337ae920541dd4d664410b40c7944d5dba05d954d238832448e177d6ad1d8dbf658b716252a125667602ab69f14e7928ab19f1f017e553002463c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94c9e3414541ad8f06f332514dacaa39

SHA1
bb35e7a3c9d33b379d84029936a03a5878b1ab91

SHA256
34d5327c08546d9e1e2b1763c1208c16c9965565ccb84df877142600aa492c67

SHA512
5860432c6ed33ba46939d961ed988120e10b74aaee3973de80977ec88e6b3486ec6140103dc8f4781512afdf5581fe9458f294b6c6838b46088f7fece0b44cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed35226df41111ef70e167db779878c2

SHA1
4ec5a0c7bfbdf85194c14e9627ec527d77d8d3a7

SHA256
62c35455aaf15087ef3a05e5804f13e9ab4a8393982117d89fc414572bfb6814

SHA512
5571a3167f7e31fb98a37dd6492c220f1fa63781faf995bd12e17af221962f46d81ad6316548aaa780a4223990b63b37935eac1e1366478bc128d79a77c542f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89c36eea4503cef4e5a60c2c79633c7f

SHA1
e9ecfd6cae79c55d47bf85712f7eaec801a51021

SHA256
51483239a9578e72131132993620eca9b190b981f46eeb7f84bdd3387dce7457

SHA512
3b558722b15b5abdee778c8c933bc6b5a990a25a449cb9b84ec928f932fb0d8b2936c9559169989f2442a81dbbb790511068700af4e9a151c93afc5c00f3cc5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
354b1fc5adc5edd994241977c866a30c

SHA1
03c1782758c36d18e519635102ee439840b8d4e7

SHA256
67383d9e340b886dd18340a529fef88a48518ad7c0f03c06a39b6139974381a0

SHA512
3180fa5ebd94bcc4ef29f554ae41dffeafbb0ea48c3aba097f24b2c2b905bc2a45e3f67d980772ba3c044e171fc4ee3c9396ecff732efe62f0d7c64fc0b0a58b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAEB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\rundII32.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\~0002ftd.tmp

Filesize
69B

MD5
cb8850e75e3f2fb25a5c4d9c038d50c6

SHA1
cb8d5b0fd4b601d5322e9345b11c80989a4787bf

SHA256
6c24f0a30ddc5261e3ece63121263a7e7cac5155ebf51ee38be1998f64f5a827

SHA512
0dedc10a760cbb3612b332a820a9f5341733a069a7ed155d466c29654426a383e67c72b6e35fda3a30bff84f9277b53cf08fa7286f0c0cbca919ed2c7bcfaa2c

Download Submit
\Windows\SysWOW64\msng.exe

Filesize
3.7MB

MD5
0ae9da583019975a83b03ddcd722ebb0

SHA1
b423cd8b885527b815410bfbaaa1ed4ec1257572

SHA256
5436bf05d6c0d951519d68a8ab41e15ef54141699ecd4a7330b9d8c158cfa0c2

SHA512
537c01cf17eba8c1b94ffb8bee5df1c5e7927e4f8dc68311d37c8d400450b9a3cd2cbd4495f4c27ccc5eca8c066c3a5c95404e902a27fdaf4f373f6873061fd4

Download Submit
memory/1596-2-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download
memory/1596-18-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download
memory/1596-14-0x0000000003790000-0x0000000003B69000-memory.dmp

Filesize
3.8MB

Download
memory/1596-15-0x0000000003790000-0x0000000003B69000-memory.dmp

Filesize
3.8MB

Download
memory/1640-133-0x0000000000400000-0x00000000007D9000-memory.dmp

Filesize
3.8MB

Download
memory/1640-58-0x00000000020D0000-0x00000000020D2000-memory.dmp

Filesize
8KB

Download
memory/2232-26-0x0000000003E10000-0x0000000003E20000-memory.dmp

Filesize
64KB

Download