Analysis
-
max time kernel
275s -
max time network
275s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
09/01/2023, 00:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://genesystraining.tteclp.com
Resource
win7-20221111-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
http://genesystraining.tteclp.com
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
300 seconds
General
-
Target
http://genesystraining.tteclp.com
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308d0631c623d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "379991150" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000005ce3b70262422786c906b028390730902a8a2240e7bf02dd07cc638a228d4291000000000e8000000002000020000000c059ef72f44f780ae77104c2882ccb432cd5d336eeee171f9903e16a28a1536f90000000f7e6aebb10d33018f67b2e3c742fb300c5c27b098c6fbe82eb6febd600009a10667e281e8be8d68b6e2bfe54f672b52ac59a2905aeb2752d65417ebb7d2ef7dbad755951e0500800362015a6bdcedbfa55d132b4cc704751669e0722f1dd3e952e18ff1552463bad80be81dcfa06c3964c3979f8224826ed6df4e746a796b79be3e0e8594c435ec8ce3bf4a4da2d296d40000000786f3709fcd09dc291880550516ba3df6f400e9b42dcd1fcc5cd4b5b93bba96da830ceae220fa4646d303c73ee0902aa19864f6ec0ded3d16f72fab65dcc5dd1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000dce30a694c68abc4dcf1c3801136551eda4603dae32a39e9fa4f1f2f4b46de17000000000e8000000002000020000000c37bec8b8c80f518b7de00c284e4acdf3a0336d3e33646062f6d837c3a65bc4c200000007081eafadeb5d950fdb356ac6b6c897c5488e282192980fbd62ffbd437b0892b4000000069a91f5d5b1dfc0bde38f2650f82d96f190b4b66727f0a01d578749364603bd04de25e00657680b25868e10de842a2c9390b763955c96e35a13b5fcb54dcaa61 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000002b52a418d4f984eae389e705446cd6b14d47af0efc9dfd901657660cc9eaf1ec000000000e8000000002000020000000a839a75f2c9afe490591c0c89b12be47490c910c6994b7c6c2e0ef190e55cd3c60010000484faadd895c466219db9c819b0b03560528565fc9ed725334e0a84450698ad4779ac08e784654d72af04a31ce1deb1e59ff8c6838cb2ffc7823f2ba8589bc39f58aaa2ce89ad9e6fabb0612cdd2fbdef6b669b0244ce6938d05b76b56550497d41161d7ecb229880bb37fd03b669d0dc31e079f309c4f4dc57904e34bdf6d698d944f993a339283e019f2c7681e2e0f05e7d5d19fb0cce29168eaab68c5057f221015fa035d7822cfd4dca1db85bb7ddc469818c68aa91df244b6312fbe1bad74a98ded55a5d4d6cc3cc6784a90ff87e1a810b667b26a266fe13515aa5a45ea56014167d733155326f92e309605b31a314ce8ea33782bf95ad2c437bd004dc4ef75d1945da26f46777938be8b728312abba4b4b7887c89f1f45881246c391a1a9e0bfc39b8dab4cd12bf6d1ffa62bb6ef4457e4179ee2bb7a01211a415b0f4eeedf4b70e439e71788afdcfaf85d5584c9655fce2a5f993b8fab36eb2959d7674000000062f99ea091b0437a2cabd866f1fa1201212834d8681fef83bdce4d60af0e83f8d73070427944691c1633edf98b4b8b1b9f2c378dfdba9411ce7f64d8fcc37568 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{598985A1-8FB9-11ED-B06A-FE63F52BA449} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000008bfb1610e87e77cbd3235bbee8f5191de65aee462eedb8ed398cedb086405b07000000000e8000000002000020000000ed78631c5f70731ff2370744569bc8056d7878f641de05f97ed759da3b7e89bc60010000d5720f3c4a1c9bf2640f68d0b43ca62d0dbafd97a2225cfa5dac969db768cf2cb10e5bd8a73c8819243088bff24abdc398420e4cbda2d1d6348914b749505dd8c0912126762f543fd3dcff0e1f95d9d47fdf30716fd8e32b695675ce36e66d317a2267ecb5242553b685045f3f4b73a477f9d016431c8c757030d73e203db95c11699591865e2261a5fb1aca3088a7bc4d29017970c0b162b672de1915fc271521b0191e43a8c43f30f34d3d241b586793a508014ed2b3f6ce8453af2ac85f8e5275fb6cc03b327409dba6911a347bfc2d5b50cd5bf4df8a56b7bc73f77114b42d74c4238f356f30195535f24ce4d631ba4d41bee09ef424e6c9e352fd97a77c91e0788ad48a71c58e42a1b2aeaf2cf578a4197e607bbf75cf545b77c60c6a2495744e272ad17f0a409374b31334dec4d3bb0c7de63056469162c849500e3f7459a49fbadb2d4811d6c7c5be86b112cb011d672ee35d841ad28b2a4bad1bc779400000001902bac17f3d3b7b0fef23277fe3e4ce314cef9e51327b1f45b145c70b3431c0d9edbb2d941ec5fb132875d08c5fb9ff1795bdec5598095ab357dd420a8742c4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1320 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1320 iexplore.exe 1320 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1720 1320 iexplore.exe 29 PID 1320 wrote to memory of 1720 1320 iexplore.exe 29 PID 1320 wrote to memory of 1720 1320 iexplore.exe 29 PID 1320 wrote to memory of 1720 1320 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://genesystraining.tteclp.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550B
MD5279f875f6aba7cda3c51214febac40d5
SHA1b74c19bd8b169e3401f77778346a4ddbc9b145b7
SHA25648448e7b875754c546dc15bca85d347e161f4a0aa737d0afd42e423437091637
SHA51228e562354f041c9339badcdcae45f75e8a9112137f5385ef57ff19d8847693eb7f559e6b34b31c64e89add05c5ba2f4780bea1ac9de05fa656474d11f0190fc6
-
Filesize
608B
MD5a855d44655b593ac1b11ad79e6213921
SHA1e1db6e8e05f18179d4f13c9e46b138249fbf766d
SHA25630cc255a00dd3f05f421b4e0f912e1a70657093e2055ae47729b640de5ce278a
SHA512b6924460e89765ab75cc0a259b4e8c5a070aa4b7759268d539609997f8d6efbc131153209897b1a8fb4f18c0529b40b97511dd2b9a92e772d7a36816ddf306c9