hxxp://locketthose[.]com

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://locketthose.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411164226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30631be2c644da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0947F361-B0BA-11EE-BF73-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000003d82970aab342bb8511023eb0ebe770064a3ea466e7840d81f083e623d372b3d000000000e8000000002000020000000fad6013f6833ac99bd22267478122392dace7cb5c5dc94b4babf1971230db51e20000000bec1c4243a059f9853e695d9954fd8a5aac0ef4e3d9560bc002cfb39100f65c14000000077e1bef6bcfecc2187baec1820a79b82b60c039e3467a42e78779e7b591da3399215f1c66b618d852bb7ff8f0ce446f9df9c665bbb1c490ec3de8afd315888fd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000008304350acc86bbf13a52dfac6b458d946b0683618142bc46836b698ac9680904000000000e8000000002000020000000740cd02533af29ecf7e775557d40213cf5d496b5468e2dcb1370e3b7cdd9750f90000000324f62c1294634145a4d6982fed4214a130fdc1b9ddc37790a9fc4c3e20e7f69d9304bb2b53369f9159e5a3601e006a73be44ed08cd83029883cd24da6ec969a1f9697f95fa8cdd8aa336027f85cc408201729ed3fed4e1d247f7d6935ce800b1051b1cf7c8a2534700f718470a60dffcccc15e24e0b28534cf70d9eca6b7fe471c30b4f80e79577910c9668d41c297840000000d2ab82c5af09c0478b68977e5b20213c14de523b15cdb0547fe1000f4e1ce812ad364f623ee6d8bf4d6373b0793ba18f77011160c9959c53345a4d5a272faec9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2872	2504	iexplore.exe	28
PID 2504 wrote to memory of 2872	2504	iexplore.exe	28
PID 2504 wrote to memory of 2872	2504	iexplore.exe	28
PID 2504 wrote to memory of 2872	2504	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://locketthose.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea745b0f37193f316cff005f1af8dad

SHA1
cf36aeecaba753bdcd99a9102daf20f9c6be65cd

SHA256
95a1132503e436cff264f3321d6b830f8e7486393e2072e4589adad2a0352bd9

SHA512
57f91d900b19b4f9c1ef474084c0679a6ef27dd96088cb3de58b37e52e02bb5ed709b394f7ba053109d5119910c95562f0365415c3da640de0568df582a12407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4adcab724ddae1a78481ba2138575ab

SHA1
8bbeaeeeb99d0c7dd09705421adde10098a185be

SHA256
234bee062b5d3e2e8a318819480fed880cf6b23d5bb5346327dcd6183dd6d149

SHA512
d866f211ca2ef50b87f338d4fa49e030524feb1fdb7afa21a0a485dd26276dee1dc95b71f38fc70c2fa7b967b6ee367ccf5b35276c99b8914da01c570d1d88d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89ffb9811346bfde6dcb4de7091f8d54

SHA1
17e7834e6c0d092271387d4fc3ab340076d3a9b1

SHA256
90d0544c0b3845aaea787aa5646879b2255f42084d09c0572e4eccb0ed7d02c9

SHA512
e1f09970037b7ddde0cf3a8b8e4f66244054c7fb5619cda9d3f6f5d65e61d04ee4852ee6d9fd8616f628f084b71a4183d0890f61f50fd74dbbbfc6e2e6118fb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a8bc5b5f1cd800ef90b6645556b9193

SHA1
f2ce0cbb9f32dcc2ed7d97e6ab07085e0ffc6526

SHA256
8d56053cb45c91ddfde957de711351f0ebe01f196fff3652c2bbd961dc93707d

SHA512
2a91e781fe0c682fc761c6f3ab7e4cea629384e1ddde9f39f334a9027a61c19db9a3e551d476195b5da5d7206b635e45e5a7f73a25b6e67e5f5d910209cfe470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd6ee7617e92d5383e32a65ec0b8958f

SHA1
ba5f95469976678f4c34e3b703e4ad1d474b7c48

SHA256
6403005f6b6c2bea8bdb7335f630b2812c930d66e8f8181bec6036897d12a53f

SHA512
32754cbd0eeac7d9ffd18bfae772f8dd43168b6fba3904abae1e65127bbda3a5af1063f6337f454fb6fb3a4b9d865c21479abe8e117e660445625696aad75a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba5b845356b32da6066b4bd5358b290d

SHA1
555a2f7e9fd5f046db3845d105c6698d7738cbbb

SHA256
627b6e7a49c2b728f8f1679b4e64f2ca2ac011d1b433b8ad0a4606730fca1f79

SHA512
c01281838c9f3d90cb4da722387da7f086d0c912de8473ba2e9019b18af0257eb7ea9defd0d5dfa913788dae239891704f222d6c76d61e6fe0151c4dae34dc1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43d9446bc27697c35a2839ab435f5cd

SHA1
0cbb6ea2f6b6f22d306375577475dcede619ab97

SHA256
301b6ff5cfd62389e92eed6cf7721ec7446b6cf003b6b1721ef17c883228f7b4

SHA512
8af6844abdf0f2f38ad1e61ad9d3f3400bfc682f3099e9af490c9e65e7fbdbb1fa79826af2ea0409d684d9d0f8d0caaad1b28827878270b37cf21aff88e179e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e0d355d910c7180883f4c9cab79f6af

SHA1
1a1fd97cf2454d21b952b43647eb3e4989f6d803

SHA256
4a001082b717ca0c798507d95de5fc0fdcb3cfdb444a7c0dacb3f07a23a6c187

SHA512
94a4b3348bcbf0a31a223ea1eb619f09c153575e02c063e5aa24220de4caedfe87f4cc5f2871e9f6df1d746b8e240bb991004fc827fec79aa69d6ea220c3a7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3ae775ebea983be7b56e9ad55162017

SHA1
655d5f557c861d34410ea3018d82dd1e25119715

SHA256
b400d13554609b82f98e684f0de01237d07323625fea78cf79bf2cac540dc701

SHA512
2d0b38b87575388e03ff445734b6106da6da4604b53f5f8740b52f9b092a2ab8cd3854bbb08ec32eb31f1d89b8a58432f83b7744e2330977549858a86b8e1942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6403a5c2180b156af5c3c5991c6ec50e

SHA1
07e2b474f436aa12f989dcebc4cd83a8ee93e248

SHA256
79e2e996f55bfbff6ea2be70b5a20e049f2f116ed2c26184b45237131ff6585d

SHA512
8060d87aff4fec24b10ca51c73a71a940ca3c75e8b601df115a45cc089dcd8317cb72b8c6c1d31ea116af5f37c97ba1aeeff09cef7c91c77bf92e82a7c6f7a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee5abe0cef940cfaafd1cf9036f0cea3

SHA1
766df2a1c9641d868f47bf49a15dd22201d378cd

SHA256
22fc275ed2c2e6d4f5bbae0e3bba632aabaeb9c50dd283a48f7bdfde02645d8d

SHA512
46521a4c205872f18f7a56cdee2f60ffa728812c30d8613c9f1cba37eaf9eddcfc9f01abb09bed2358ad7c3bf24bffc3ac27ed30580045c56e53ce39459a427b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7720271e45141704d9b1b927ae5236e1

SHA1
45df56ff7a5373a57ae1986dfe2ebdbabb48b8b6

SHA256
288fa94e9e394afa9f99c623b9bdd679c8b62d444ce205e87ee5e94dcf6ae533

SHA512
1fd25317470629b46f38a57f0c7ebd2cb3ef9158c5b9cbfa111b29d960071921d073c65fc7be948ef233c7e63030b2a26cebc7c894374c5796eec14b20fa9a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e868045ecd460ce4128c68a0a2d814f

SHA1
477d8ccaed1c5676cf6d0ef780ec8fc0fa18e11d

SHA256
ed73e3bf04743c6554943a14dc348c353565265ea04ee581eab2fa8244d21f68

SHA512
53f4a314c67d81cbae759f8225f61c8db8529ff041a2d586e3b161ffe2f8ee7b3cb194faa16f9c3864ca0928df4368b4b634dc8896b6e7fc1d4a7cee63e5a51f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87e330224680d9ea13667c80faebd134

SHA1
6e7ae01cf2fcfa032b585349699d71ed6bc213fe

SHA256
bc52c8b09da72edb350f8b88c11eabfeefb6235b326c050c5a980e91c948e1f5

SHA512
8d3d3968f1376a140ab6633e7a784d42d12f89c84a1a4e870e297f25d688ca89e826b1dcc5cfa5363a3ffb39326a7ca912737f8cd29bb8ee3675bf470b5bd389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wz5r4lq\imagestore.dat

Filesize
5KB

MD5
fddd3ea388ecee77e79ad8316a9bc427

SHA1
c58d9418f2652317d52ff3555f9dc329ae25b5dd

SHA256
df380aa24503b1b0bd19e8b304a4665aa9e702fe6ee007dc97d0e6c0be9ea8ea

SHA512
8d5feae7afc25011e280c7f1c5a61e8112dc37d33023afe02ddd57c3705ca3705636f9aa3ddc72e809eb696648e26821e597639ad10b154b51482d0413b48d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BAF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6CFA.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit