633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
Size

3.8MB
MD5

a6626b71acfb1b02c3701ff6d9488150
SHA1

470c0846b790506728c9dc4c5616e3cc79e7103d
SHA256

633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5
SHA512

60d5ca672277bf55a648059fd6bdf75fd4c5f29b19795befc7ff7495dac1bdf0694b04c36c4adbdc1190b7bef9cf7734da803599829c890f035ab6a8bac8e735
SSDEEP

49152:1fs6Ds61AsNHyva6SRw62VBzCGPJ+kOWIFa2XWI1q+GUWI1q+GdWIbqqDpWIba2s:FswsUHysR+VB2GPJ+k6R+VB2GPJM

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe

Executes dropped EXE 1 IoCs

pid	Process
2764	msng.exe

Loads dropped DLL 2 IoCs

pid	Process
2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	msng.exe
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
File created	C:\Windows\SysWOW64\rundII32.exe	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
File created	C:\Windows\SysWOW64\rundll32.exe	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6A58CD1-5CF2-11EF-803C-6A4552514C55} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d037a0fff0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430100193"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000005a51250c5046142b40007330e730107f8ee47a689843edc04b9c9a3689549d13000000000e80000000020000200000004265e3990e25934feb6c93a46dd0b51658e6bf6e287fea01093473561b025b9d200000000554dc3c5938b00fc05c3a194618c23611b595cc9194fb7475ea67ea24b6f17840000000979e1d8a6ba9430c9b63cabbb96835e5a32dd9fe86d269eb2f39ae8a99edf3041997ba1987cf9c1aca5277dd6f664d7d185c15b366b2684edab96443ece41e30	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000a36503c8b3f41181e5ed26dae3cd96d1cebb5364a63acd9ac5ec7e9d87f2814d000000000e80000000020000200000000bb18958843d1529c07734d9be83c6942c6ad1d540c077aa819e7dc538903ac090000000f03bd82e144292e7e3f26b4211991975486588beae9af04910af0dbfe8b1f30c41ed526cd78071636ebcc2455ce74c529fa3acedbc2ce3ebf73d07c5ebb219f4dae086c72060b46cbf7b6eaa8d1efc4c09bc6d827ecdc9bd71d118a41e69290f5566e0dc51f0fa218784b597da5a2a34e46577a6c0679913e5038c6d4b09a9847167d41a38819a2b2e247e56ec8dfe5d40000000614ffc5affad548f00558d74608b18ff4e13065f7ad71406fa97b0e710aca2c76e1650b1ad39298dc4009519fab0888f2b0509af7951b09f19051226b83c7dd6	iexplore.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a003100000000001159adbd102054656d700000360008000400efbee55873491159adbd2a00000006020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000e558244c100041646d696e00380008000400efbee5587349e558244c2a000000e7010000000003000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = c6003100000000001159adbd10203633334131427e310000ae0008000400efbe1159adbd1159adbd2a000000099301000000070000000000000000000000000000003600330033006100310062006200660034006200310033006200650063003300620035003400620033006500380033003800620031003400620037003500630064003200620039003700380062006600340034006400630030003800350036003700360033003700640033006400300038003100650032003700340065003500000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000e5587349122041707044617461003c0008000400efbee5587349e55873492a000000f20100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000e55873491100557365727300600008000400efbeee3a851ae55873492a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000e558984a10204c6f63616c00380008000400efbee5587349e558984a2a000000050200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe
2764	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	msng.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
2764	msng.exe
2164	iexplore.exe
2164	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2860	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	30
PID 2252 wrote to memory of 2860	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	30
PID 2252 wrote to memory of 2860	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	30
PID 2252 wrote to memory of 2860	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	30
PID 2252 wrote to memory of 2764	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	31
PID 2252 wrote to memory of 2764	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	31
PID 2252 wrote to memory of 2764	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	31
PID 2252 wrote to memory of 2764	2252	633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe	31
PID 2764 wrote to memory of 2472	2764	msng.exe	33
PID 2764 wrote to memory of 2472	2764	msng.exe	33
PID 2764 wrote to memory of 2472	2764	msng.exe	33
PID 2764 wrote to memory of 2472	2764	msng.exe	33
PID 1304 wrote to memory of 2164	1304	explorer.exe	35
PID 1304 wrote to memory of 2164	1304	explorer.exe	35
PID 1304 wrote to memory of 2164	1304	explorer.exe	35
PID 2164 wrote to memory of 2544	2164	iexplore.exe	36
PID 2164 wrote to memory of 2544	2164	iexplore.exe	36
PID 2164 wrote to memory of 2544	2164	iexplore.exe	36
PID 2164 wrote to memory of 2544	2164	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe
"C:\Users\Admin\AppData\Local\Temp\633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Windows\SysWOW64\msng.exe
  "C:\Windows\system32\msng.exe" fuckystart
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe http://www.OpenClose.ir
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2472

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0854cf78bf1cf70c118963f3bad2d60

SHA1
b66038b682956db59cda49020b12d74a7ab284de

SHA256
7c770e1f253d29ad0463069e5b7d32c02087e6fce617a4be810ba65eaf6fa3c4

SHA512
ac9fe0a3940865db4d8d610c92ab243507dcf1e92ea0150d745f49b4398e5a59ff6ef6a0d4a9c4e843d74c9e9a7d704974b84d2b5387efa073f7bc30964a933f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc4896368d88c788862149285bc24e40

SHA1
4ac6aaba27df817cdb1e13af6ce04bc03dfa9edd

SHA256
1c9e0bfeb758ce0fb5b3c11295c6507695b12a6e4944c3793f0f2b5ca609114f

SHA512
5afb494c3f2ae8e1c4e6807c5a40528f8a4189961be9c13d68a111aebeaca41821fbf1ba9b0db8d9a2688a9ef630ff67a1f91219b3442dfeca1d015198641ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ad3927c95a63f8a7d3ffedb9bfef9f3

SHA1
7d46bedd308ff144fff691732cdf130df28466ea

SHA256
669f8208e401525fa762305aceaf66d842612f4ec66e3f35a61a7d8904fe0578

SHA512
7b0d51287bb1c7c301669eb41eab1a345205e0d3aa53072f8f7363c1f11ff95d6c6aadc985fe87a1ac3bda3d8297f4a3b0d7970c1c985e81bf6018f0003480cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71e8d857dbbb6950c74031818a3cbd6f

SHA1
c26de8624eb46a7aadf0582cdcb0532a174ee890

SHA256
8776b448a3620ff5220a138cb5f51f3bd8e59227164cc799c11acf03c19a9af9

SHA512
0609be0ea1abeb7a58bf0cfae6715ab253da51536a48deef1a61a3955fb743b6e12e4c93d046cb3d6b98a265117cb795c4f4a010f7c40acf10327d6711a3e6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b87e67a4d65b3c3085f846b42d55836

SHA1
81bd5e3bd47dd076d6e5a40664c8a4a72a8d0448

SHA256
0f1f5936fe0bb3abcd2e50dcbf031fa56266086b5292aa639aefbdd576a9d1c4

SHA512
088ea83f79e8792a9cc06307f0bc7c5ab046b2f16eb574a84e77947596920b02b18c775d9964f070e58c70d3381a4f207f73a0a9a2ba251d17995a371cbc9375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c1dce9ab9883fb423cff823102cfa00

SHA1
29424c54816ec4d5c01eacd33aaee70b6aab88c3

SHA256
96e6e774dd7d001e30eb1f90dc401d6765b0010a09dc45103504534ee76b6c26

SHA512
e93d5a283f66f85ad134b75356d95280b66688e883fa9e38f80b2b27653c5f9321a7da10a41a1535f0ec923d9899a1a924848521caa18c594f9d65ac7a52ad1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8be90b8a9ad6e4b57a05da9ecf4ea8d6

SHA1
16692120fd1bf2b53b950925455304e5e68f251a

SHA256
0c4f8dbf61454e1b0eedc055d3e7f6f9febbd045b51d286ab37c92fe17981849

SHA512
d924d81b5d8906e90391d0e7ecfbea2fb896c57379e5af8526d005b6be55403d299c1455b7801da5ceeb51d08f7142a3a5e3f21e48c8428e5112994975385b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74f6bedca95c9e17a286f429998b2ab1

SHA1
52da78454295e5a848a2ab0539d64593e1908bc1

SHA256
88ef66d8c4969c2a1c5f4d3d8439c2b7315b85638256ce3bfbe255d0b6fd4f68

SHA512
71e1620a042612f6d79e5b6b1e3c298bd232a57a6286682016b7a05462ab28a4fb2a75673e7d61a46034b18419aef0a30c73c52442df55397447bbf32d0251e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b53c942632cecc08c950e7ef5141a329

SHA1
e9f3cff30b0666dd37738366d713484ec1a2e777

SHA256
9f1738b59cdb71b8a3a5027da47db07639287273ccba44cf34203cf170af8671

SHA512
aeec06646619138fe0842be65abc471a849cf62afb4ee1cdcb2eb0c5520f7e8e2ee0f3442957d1e4ee24e460e4b418f9e50898f26d526f227630914426ea7998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a6de6bc86178534c8ad2ccbd8356619

SHA1
a527bbde70e2abf018d70ddd9bdb6be194166c81

SHA256
fd2d0c4d9ffbb633fec82d09fbaf8f5e0000ccd9816410633e28afaec100e14b

SHA512
0d14446ad72b8d1b2d48fce6f2f4d459e3298722b39f609e6462d04ed720e1ae2486972230e34814f66bbfd86de567acf62d89aa6420a31395858c291cde10f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f58e218e9ee83af843c39708f284ed09

SHA1
715526bbaa56d465bcc1dc36911911a2f47eda5a

SHA256
9ea29a76d284fa85833dd8eb2887b747d62769366ddba187346a528599e62cb1

SHA512
9f9a390525049124f057414e0ed40cb62443cb2eef49e7d36a18ac2990d51809da398db9aecca99eb63e6ca0a396dc89b8185779d35487a653e486cc1db37fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6d34d3f14bc62758871120d9cf754f2

SHA1
658764df08f59118990a3e21c831bd579c7fdee5

SHA256
263dcbe0c65c19e53e57f9ad4825705e3a6aaeef2e72b2da0a94855987ee22d7

SHA512
c1233d5163801c968af6f433356fe7ed44c8a009f191f6da2a21b9ad9a22892b4fc41cbf050d44088c307a362d948efdf0f9c4b377b48d86409fe68963ebfa80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
935f1eb0cd427c9dfdbe0affc6d5a96a

SHA1
475956e89a1ebd5db2d406d0ada38aeb996c5250

SHA256
733b20b4f08a01ce09ca86f9f5b4b010b8f1b7bdcab20ad8fe18b31f093b9025

SHA512
304b50a092b3df7bc5296b8be5be070d51edbd2d783bc34c38619638812d8f08e87b72948e3ff9b17fe94911daab1124df31b1d4358a97e59bbdb2cb6c44ae01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5a64d01f256115f664e226e011f3320

SHA1
3a917b14c5d19d57b008c8ade30f7fe03057f063

SHA256
a2913b43593e2fcf1393ab2f92e176c96524b65014d5632b09c1507935e8b5c4

SHA512
29ed25fb40b5c03721f88093fcc42c837212dc353fa72c9b1527a2dfbe9ec6b16aa356a45530a068e434343cac2cff5ad43a50809615890640b394d478bb7fd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a752508f187f040138f1544a8218504

SHA1
de7c9b5feca77eda8638784fd10d6229c67b5d87

SHA256
d067adb774701f09a617e5ac4ac053fa42499fb352b9e35b334f20e917bc8bc5

SHA512
e49a092b32ffec111217997eab04b57bac69938ac1e6c231a09af314754bc4459407ae0829d2d99fc80342601aef05b26c35bde6063ca2f22334f230f10508c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ac8548a8ef1a9b709c3e501dc20c361

SHA1
10450a708200d975d48445c8e52ce48ad8fa96cc

SHA256
fa702519ab345baa8984e9b558bf2982a6ae37f9b20e130d18f3d5f45caa3b56

SHA512
8b41100ff924bec5bdddf6f55e1d008ef690c8e62fcefcab93d982c757676604b4df61dbada42fcfa01cf15297d2b5cdfd8bfeac9790ac06551b9bfce5a780c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44f5c91f4430f9223ac3a237679e8ce2

SHA1
585d27064cc92c5052cebfb59f425bf8a95baeda

SHA256
0ef70876ccc7739114c28d43a90ff49f89c4cd92ed3eefced70f42665e8f9475

SHA512
067244d23b78ea6ff69fec0a3ad31cec5a0548ddfb4fba1cc4fee85c37b8fba966804661b4485846c121f92b120048b3cad9880701f7680682edfcd4afbda38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d18e2b2eefa7b554a73eda14ac380d9e

SHA1
df38c4740779eac927ff9b28be1ebef99654e39f

SHA256
13a79035c9b433aaf64ee5ab911e56dff7873ca5b981b16c95b51661064ffa3b

SHA512
8e90abec803fe7d476619c220ee9c4e014041e308612633d6f5f962209de54c95375fd9e63197b12f94c5a06f77df0a2f00465c2de3ac90a9ee8cf225450fe77

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC5F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD1E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\msng.exe

Filesize
3.8MB

MD5
a6626b71acfb1b02c3701ff6d9488150

SHA1
470c0846b790506728c9dc4c5616e3cc79e7103d

SHA256
633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5

SHA512
60d5ca672277bf55a648059fd6bdf75fd4c5f29b19795befc7ff7495dac1bdf0694b04c36c4adbdc1190b7bef9cf7734da803599829c890f035ab6a8bac8e735

Download Submit
C:\Windows\SysWOW64\rundII32.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\~0002ftd.tmp

Filesize
100B

MD5
e53f1a809fb6ae99b7620b7aa15d6ea6

SHA1
4424f8e6667ab0101a6ff5e2ff5c7243101b64f4

SHA256
28a6e26ff1f6ea51e8f382bb2c9dc3982f1b56ea67f448e6d160979726481c8b

SHA512
5ccf8e9074ca893e8e38adb4670afc88cbb720f9b9a3dc1ab4777e7fb4eedb2f6559d68ee9d8d47a692f2ecb42ea67139773649b24c54a4d62e50fee164d7974

Download Submit
memory/2252-2-0x0000000000400000-0x00000000007DF000-memory.dmp

Filesize
3.9MB

Download
memory/2252-17-0x0000000000400000-0x00000000007DF000-memory.dmp

Filesize
3.9MB

Download
memory/2252-14-0x0000000003780000-0x0000000003B5F000-memory.dmp

Filesize
3.9MB

Download
memory/2692-25-0x00000000040C0000-0x00000000040D0000-memory.dmp

Filesize
64KB

Download
memory/2764-33-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2764-122-0x0000000000400000-0x00000000007DF000-memory.dmp

Filesize
3.9MB

Download