hxxp://concsoweb-prd[.]cisco[.]com

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://concsoweb-prd.cisco.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410868516"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90602d761642da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c965e4158a405d82380f9abdd8f7fd3713e20fbc125b9b397dde8638453dc015000000000e8000000002000020000000c83eb4992e37cc18ed99faa1973f408bdeb36301d77bc9dad294c3e2fb6ff11b20000000b93874ec917b9c8c5a9bda4da58c632496659441e5f2159530a0e213d7c7d48c40000000b39fdfb1d49137b66f70e3ec4299bb25971d0767be5e1bb0a90552da597a85d6bc00c092ca66513173af11cdd05de4d6543e45219f31909f854ea7e9e4748be1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000abb7f68fafcef87aec67502332a4d4862553c33e6ec06350204d1efa7f91b557000000000e800000000200002000000069c8ea485b32e5c7324f713de4227d566cc3ea7e042bbce6bf6bb42ac6a6ad83900000005fe815eac769d8de488691a6506a2ba0870cf7b84855a7c41bd701e1d6a7ab6d6b853e397961162b2e55744e248616e828783742462d63717422bc36b8f37cdbceaa8264ac8056e5724e3fbfe0070d127bc6b2601e0cb0f538392f1fe3733320711f352fb44847a4e5e6cac7644ab7bdd64095495b071916652e9a32b751e6173e1638efed1ae5eed9278a30c1a1671640000000e7c4b5e9b0daa201d6a75c423ae724daa756b1a94fc24f888ff614091a449a99d44a3f3f7fbe32234c9a94a2c790d2246084f88073bc2f2af59461f5fd02307f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87FA8141-AE09-11EE-A623-CE9B5D0C5DE4} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2308	2532	iexplore.exe	28
PID 2532 wrote to memory of 2308	2532	iexplore.exe	28
PID 2532 wrote to memory of 2308	2532	iexplore.exe	28
PID 2532 wrote to memory of 2308	2532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://concsoweb-prd.cisco.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e99e2b01a22f01bb11e8b612ba933904

SHA1
044ef29af0e68e4427455074f54fcf65762e49e0

SHA256
4b105d74aff5e378603d5c9d4b12e0b96eba13fa3ecd63b9602d0de0c9e760d0

SHA512
e92946170112865c3eab3af850a02b174d08ebea2f34dae629673468653c775c7924f1bfb0419ce7931085f34fa54adb66fd85d76eaa2554bbad354e871095b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81257fb4c81934ec64bf61dc1c7efe8a

SHA1
50a001b4fe1b6d2019c5e538146b26979f956157

SHA256
354a2f9e11e70c53e71fbccf46480aeaf07b9f15175d2a552deffd0582786e74

SHA512
47e930822bf3a957ff1a7cdee0500cafe30a3fd05325f7bb609a3b1bfdb4ea81ab3e6a31e3fdaec182689ddca63d7c99857933644167293522304f8ff18a6b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f16e1776bbb49c8f0902e98fadb1b751

SHA1
a1cfa780bc83af282fa675cc9f377fbfdb29a6bd

SHA256
91f97e9a47640f088b3ef9e846d1ec5f460801e12a28d400d89b24bd757d09f1

SHA512
7d703af8b932e1be9a3bed85187047750100d097fa9238ecf75708d3c2868652bcd0e946a6301fc506df9456f8debf8982fc321b3197db22002b02c0ca5c7ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7768c39c44cd87f0cdb47cc75b066972

SHA1
f03444b14135c96ef3a75cfc94638db9b2076554

SHA256
2cc5b986eee957856b733daf7091a1216f9dcaad6d9edf1ef68c04f05990cdca

SHA512
a083bd57540b7b4fcd81c7ad6fa862853d51143fa8c5b6ddeffac268a675ef19a720976b494ac4802899bad4aa712b2b35254400f23d56586f57ee8bb38f0cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9116494d0c200708156e0cf29d9a0b09

SHA1
792458178bf2cdcf6d11e4546c5270dd9e8118a6

SHA256
b9c71714d51b208dff95ba85ac03c534806d2a6eca979df51e2ddf736f0d000d

SHA512
299840f72831526de321f9833abddb21d03e6dd0e8fa850b627c3f49e955439fed0a99ff9bd602dc83412468a6ac91086faa9cc02a3b8ab2937e741c6482ce98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd451fe6f5cc6d7d792f25e6b5eb058e

SHA1
feef9fe0aeb5b712c6218c2cdc208e5c010713a1

SHA256
aa46b9fc4cba96d9daf48d0f169c5c01f5a7ec8db2ced050715fef1e7eafb71e

SHA512
ced71cb6be2b9784d3885f719fcebef6e0ae9ca7202c58869780f204351f09ec2a5c3955eecd0325cd60675ae58c48898070e7eb64805d167ac7e1bfd8de5a2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27b91d505a9526cff0358969b088712f

SHA1
4cc53466097b639c44d8ef925e4e2ec4496c3bba

SHA256
6d96c4baf39fbad03604f045e8cb26aab6a06c5a945290766e7071193519fa0b

SHA512
dda425b988bf8e7bc486a5b92bb794aeb4cfdf68db433d87bd6ea448667f5e97fe23aa0f55ed8a8a55b054215033806dc42eacf8a4eca8f193a3478da5079e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddaff734c1d4f55754402c2c68680152

SHA1
5a003283d5034d63bfb44c2359fcffdbb612aad4

SHA256
853d2b413a820c9582eb7aa68b359f3005d3dcf5e5b1525842d07244fb290ed8

SHA512
035029e34a2df632133bfa2cda68f774f9c0e4987b4170b0158164f9355d8d0f7e375000ba45fcbaca35c388ad9d6b08e2308e417f8de5f316f5919ab2674fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9c962381cac94ae842a6e77b8b43861

SHA1
1e6542a5c3e6bccac3d787757328b349227f311a

SHA256
cc9a364aa829ce45967089d95d02d3b1983444c22084afaa084dd419481560c7

SHA512
b0be3a1837ebc3618bdd7532d2c55db077c087d9ad484c5c7b9ffe07c6aa6f12b295ae1970e56dd14cd785689449e16fcb3318568ab4f81bd9957a197e6e87f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c7333d5d9369249541ddd279b844a66

SHA1
058178513fbf36f07cba0505bca12afadfa7340d

SHA256
ce377989b57e32c5bd52e288698d2212b06423444c69f4a460141384685477b3

SHA512
771eb4912b11e7f57478e667e400de2df55551736d568c30fed8b000c693ea53414ccd878c177725ef20531b8c51d24850d74ab6ddf2c927a7496be95f802e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b762b988ff8d88532079cc4115d5c0d2

SHA1
ec059444a0a236475e66de4f971ba50984aac3d0

SHA256
ba1a2332dbdeeb78380047e778b7af80200c64edace9eeed636340f9dfc5287a

SHA512
0d2f53915e2cdd92615b0322700e66039bfe93ae8243c185e131fe7b893820e3329b45044d7a1e65dbf0a658692e056bfc1da1d207a273cef8b690ada71eda5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0599c8c787679551428c84516d8f895

SHA1
c6c14acd58bbd8f8a03602abb5c87eefbbb18bd3

SHA256
3d022b140305d70002bd658b2e770e7579c3b3a030fa76e1441c91a51230e591

SHA512
1474dd5456359763edf5004b6066bc786ee6b774197c28a97f3f0d71788d80d134e24a6f4ca29e6c5a7c4b17b98800f0061f8dacccf12716581e312c02519445

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8DA.tmp

Filesize
22KB

MD5
9a200c0d8aa9a7e7619a31670d871515

SHA1
a0316178768d8e04f12ab4976de7fd5289fec818

SHA256
fbd7321115fb7fbc361be25209a858149b9272287ee517f21efb864b6ca4f741

SHA512
fded6aaba0bd6e53f250a3975f5f1188b18b3e7196ffcccd5675eb435ff7482ed90fa423e693b47afb186fd0673f3a39b1d3f6eee57205199495f59d89bcf8e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit