Analysis
-
max time kernel
115s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 11:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gecorp.custhelp.com/app/S2PSupplierSupport/customer_inquiry
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://gecorp.custhelp.com/app/S2PSupplierSupport/customer_inquiry
Resource
win10v2004-20220812-en
General
-
Target
https://gecorp.custhelp.com/app/S2PSupplierSupport/customer_inquiry
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9B76E21-6B2D-11ED-A34F-EA25B6F29539} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375972957" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000625700e79789324487d81012283cfdbf00000000020000000000106600000001000020000000227b7f3b80fbbb83e4825acb6e34c9b80901c1ef589b4f19ccfc67b553b7fb42000000000e8000000002000020000000a087c526b154b9a987beee9b08810079429e8c4ec8722bb077e4f3631ffed23f0002000060a1b23c4b162672200d027ba0108d4b52aa6b3ae4b26e8e84de4ee0161b68cbbb2a31c7230dabeae042df8473dfa417a51994b11864527ede588e2e353a1ac2085a5b1ca903dc5c37a39658ac41425454df413d2bc3055d99a8ce983bed867255b437ae84e0d436a43c6251a8df26979ff29d7aaac2c0dd1bcef0420fe88dd596616cf686de4d1ba5a0f1ff6a656820df991493379c9966f8b578ebd61ec48a12fd5d6319e7406f1dca9772b3af85283bcae8eb8f0078a8efea6116c7aeccb505c0826ed88a58d4f3aa5043994e12e78e6956a5681337898ba702a1824075622123a729a4f3b463597d72da14d15e1587577a887095ff9d5ebbbfef732c3b6a6474444b384dc8e2e3b1fc36ebdedf9998f13d9901979dbfcebb6e1dd6d4a8e7f0ada68fc54abee8c0ea54cafe53bbf2ea9e536d80ca177420943d478b150192873fcd99f986bb94ed09538b1e304153cf30c18adecbbc5d4fa21084dd9217c0f050f9d037550de3eb7b0dd6228a828361a88dd904cb195aea75444e7c1430fa4116d972a80e8728c5f01950376271b6d8f4bc72ae33f6bbb3605c0595d42d45bb92505b6146f6771201c61c10f66550022f4865ebaa3d40ca4572a277b199831ac6021452a646537e03d812b3f6b93d6a221128263f75c9865c03961c8a75ea2a8c9e135dd37601ddc88a3669601632e7ef6337c0174533f2667c3c62e3bbb240000000075ba5455c45f119705c688d73a728ebdb2da993401c3a2c12226474a0979e64849979da0a53a131d459eebaae4e1a9fa260db0fd5cd90f3e486090ba81086e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000625700e79789324487d81012283cfdbf0000000002000000000010660000000100002000000039252f14b8bb6ee646c0a271d2ddee9c3d392d100b8369e164f035b2194eec66000000000e8000000002000020000000d01d1b7ad530b0f401cb845cfe178ec0bcceaee22428ee74b20ab764e077751590000000975a9f55c510a823e9fc805cbaf458a088932dc7d69a7bc312fb0278397729b7320188666761154d628e9859da3c99e93a80a5fcdfda9d5224867dfb6919953aca0d8bf83980cfe4ee10014c0ac73737a51074e2d3e7ca3765dfc3c4fee74aab865daa6ad4282bc7d33866d629064ac0b96ad97779c2aa4afdd8a81f504fc4ae22b4842a2cbc9224e626cd5d2505bef740000000518ade8a02d3762f385f744148df28069d79ab3a3ac768cafd4a6b6d2ae2500fc750461d667a23b6dd0b4659260e07f86b9c39aa282b848a0b0f818666f2412a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e485973affd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000625700e79789324487d81012283cfdbf00000000020000000000106600000001000020000000fc0a723dc7e4c814094d99896432ee01287fc3bd39a5d4d26e586303250acbeb000000000e80000000020000200000000d976774f2eaf596a656fea9ffd6895d157fcbe1e762ce7ca84f8664056a5d4a200000003fc654bbe63456e5c7576d6d7a1bcd461d3bf1b1660bfa42b748fd2660449de84000000076ac61efeeff5647f10de3d3a3560dea7b8387638a1404fa71771761a016214c6725977be97b8f9d17e42852309dbf570a3e83d8309711f74ec60f67d2555ed7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 800 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 800 iexplore.exe 800 iexplore.exe 1468 IEXPLORE.EXE 1468 IEXPLORE.EXE 1468 IEXPLORE.EXE 1468 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 800 wrote to memory of 1468 800 iexplore.exe IEXPLORE.EXE PID 800 wrote to memory of 1468 800 iexplore.exe IEXPLORE.EXE PID 800 wrote to memory of 1468 800 iexplore.exe IEXPLORE.EXE PID 800 wrote to memory of 1468 800 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://gecorp.custhelp.com/app/S2PSupplierSupport/customer_inquiry1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:800 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1468
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD53dcf580a93972319e82cafbc047d34d5
SHA18528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA25640810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
SHA51298384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD552a29e91da78ff84e0f3b16a925bf542
SHA1934fd71304cacb6ceaa7cfa0e6eff7d20977fcd8
SHA2563fdac45abc4529ceaf6fa80f639472f37fcd8ade92405b0b39a088015db4d476
SHA5120a7acaa1da25bd315aec06e988eb9e0c65d7c74c170f2d69d5a78ccb4eddf70511d2bf49b00cd88c117dbb1c985de2eb4030174e48edcbbdab3028b5151c756d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a2b3b2c76578a4c25161be8a40b278c5
SHA1b33e704977508c1c4c99baf1023fd16e28b70eca
SHA2569e0dca9e9a8f43e941286ca30863a295b137ad3e9ee322b54bb6dc24be1122bc
SHA512a54de9b0cfbe3353f98667bc3b86ca96a15304ef210548ca0ec8dc7f7b1d49325f64d6eba5f841ba6ed28d8a24b667b53cdb479994800fb0db129eccb7b6952f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5cdd701fa5b08e00d9246277d84ded43f
SHA143b48e91969cb187a4f44b9050f16fc60e220b8a
SHA256f293416153bb1c946bd72be6c5518a898e6c3fe9ff2be9ce8a17147030c2911c
SHA512c2f7eece264665d82a693fa0c9e45a0eca0a1bc1048418b5cae65f573b9635183889b1f328061dbef72b0a02f33fb507981a94074fa82d9f8ebe34059f448d1b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.datFilesize
5KB
MD5bdaa3a6b6d108d84f543472d9f44bae2
SHA18fb49de32a2ee5b40f1b7bdcc45bbbb8c39e6af9
SHA256485959a41d0b3a7470f55b9ac5c6debed8c9fd16c48e8dba2d277f3b50dc967e
SHA51218ad6beb2d87ade20e4a41199a58863805c1fb7b9000e81b0114ec0aa1bdcd6456a09c73116f9daa64495f10fe12daf2ff52fbdb0f290afa508a0a4b6bab6da8
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.datFilesize
6KB
MD5acdcfbe34df4bdc42ac4caad82691f5f
SHA126b8261c6009f02e0d503043b631eb47891d1add
SHA2566b0c911d6a4ae9852f91ede45919f574653c0340e99942445f536ded30c6315d
SHA512e19bd579606fafea60b877dc1798d8394131813517c00cf5e5976422e3919b0f850d47e17fc3bc1a662c94030ba4dadd231e3951abce22a1c18bb413f3a01902
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\W9SRTWJT.txtFilesize
608B
MD595403ad66763b6797693612287c45f80
SHA1aa0893694aecf1a1b1456a9277ba0be3b87df72e
SHA256b7358f32360b17c51de3ba84f2fb6b3595c39047d5d4a9a8a6837e8f72e58338
SHA512e8bd4add04b1b197489e57e42a1e1999119e44eada9ed5be048882998464936cbc851b24a2441a51fe3c379d6fa0e6dc77df62dd740615513a01a7c5c35965e9