hxxp://2024-01-18_02f09f51b10a96d5517be3807de9f90d_cryptolocker

Analysis

max time kernel
172s
max time network
180s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://2024-01-18_02f09f51b10a96d5517be3807de9f90d_cryptolocker

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c0ea86034ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF888C81-B5F6-11EE-B160-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000092a38d3312fc1699878ec2b86b6484859cd3d7b4f4d7ee3a30bbffb7958fb1b9000000000e8000000002000020000000d5ff8edb6f8e72be0ff74054817767fea0a31562a305381aaabdf11ed103237d200000002a770afc8364b031521229709c18914ba2c9ded140bae1bc2b07cbebe896691f40000000ef9a1642cf6d14a553c678334a6b0733c51c155df484245787d121fd43c6ef40027816b395534b763c978d30af485e81eff4b78d1daad71890072becd5c95331	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000004c3722c755627764cb5cd453d4cb3ad8a7e892861516508e76e6b037fed5adc9000000000e80000000020000200000004d821566cb8d28ebdc42b7f225ce5c045d9c5b33da0cf9c61f55e77841d8084090000000690403ed4aedc1feceee2db34e6db98d93724a0d820b023f0efc9425a5ae696182a5dd5a0b71b3c25c6afa3c1d64afd1af8e44edb1e3094de3ac2fc3bbb44815dd43636dfdd3cf63220ab136b87245477aad19ae474aade2f8c08a728d1154f7a10d43d9ce1109ba78b61ac14dbbcc12ac9b2ada02aeddd0272d7a56ff23c43c204eb278e5ac9e2c185a5a238963a404400000008e7120a6d93326d640bfe03b74fcd878b52cd36c1088b61f8a1fa8d3afce17181e2a7ccfa0b5c6302609deed4e034b583859b6197bce3b1d6474b9289f0a8f5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411740043"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2016	iexplore.exe
2016	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2420	2016	iexplore.exe	28
PID 2016 wrote to memory of 2420	2016	iexplore.exe	28
PID 2016 wrote to memory of 2420	2016	iexplore.exe	28
PID 2016 wrote to memory of 2420	2016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://2024-01-18_02f09f51b10a96d5517be3807de9f90d_cryptolocker
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
449a5e872ae8688af9d506e9b012bf73

SHA1
1bcb0e2b489966ad09fc91d1684e85dbc22f2581

SHA256
81b0afca586919bb89599a7c804f775c693fc26b1f6e96080aeefec43013054e

SHA512
d747f62062ec6dfe9b6e51954b14e4642405e394982fcd0199a35ccb241244bd24b667f69e8f91f3ed78668eb07717bb67b015ab8b44ec4ce90f2c6c33774f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
833383e2b8b70682e4c2f3f0fae2334f

SHA1
84e574c1ef714b0d16a561f46bb1371a70d94ff4

SHA256
beb25b0271a22d593271ecaeec737a8bcae13bb68f7a853f9a4b6e28e2daf713

SHA512
b567ce1870d39ee8c065b851d859228da7c8012fe04a2404a6a2938b7d14a439dc02b80c82608ae84f8765337058ad6816e6086c913e7255f8780f2718ea65f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
779874130283ae0608a3a9c45267a07d

SHA1
7524f3efc638fab96eb451564f7e98e13354200a

SHA256
3e2ff8c968c1b4e65816b536dba7014806d8aa22869db21af577f4f3f8339974

SHA512
f32c01a12f580cba342a15951ade9ccb5794e1c82e363df2352a58f1d4bf3b53bda951d8e8652e71973d5c2d1c7d40362721f9c61ddd1c66e7cdb82f9c9cf10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b9700a724ee9a026b7d37bceae42df

SHA1
7e4da2ff4102b2ed9d4f4d0ac48fb484f40046eb

SHA256
479229476fe6939cab8fe8329b2c172cc63a10de843d8521730490fb49766f7c

SHA512
89f46613c18cadb27e2a0d58516d19275a0f75be9b00ceb196cf12c04482985d4a2a6e75cb6c598f5add92cdf817eafb2de929c8a65ef1c46ef22bfbc07f9c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e74fc02b4cc6d674daa482d406cf77fa

SHA1
0baf205e011171203bd0bdddabb4c31da281df1b

SHA256
2458f6ceb6552a107f423c273086e7310b69196fe84a136714a73fca17f01022

SHA512
29cbf1924b29768ab84af5d1ccb72ac3ca7ae257bd068088645f2d6e9360667ac778b49753bf7ed8e7df269b753a119135d1bb1098c14d0425e580b77eb0be6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356b5382bce291d8b4d9225c6e04dd88

SHA1
741f35980b35006e21fdaf3f04020042baa931aa

SHA256
7f6a7d9f8a9fe7af30c1a6ad6304a71aa9d67a55b3bd3b80c4603ea6f5d26f9f

SHA512
e2f28857ef9447b49f3b160fba8208fe6cfbe8a2c460e3141fcb6ea2f47e1de67510ee3cc473fd2b6b4fce47575654e0b7b84021828d18c24cb8b276d79eb54e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afcbd3e22671814bb396b5a8362b906d

SHA1
48a1973bf9650fc67cb43a960e6fad2d3b143b55

SHA256
df760a0bf72fe49a36dabf9233fb7d48e70838d603f176ef90ee312a996f5400

SHA512
0fdfe11b64f195abead22f88deb094656bf9c5a24f3373160c48dacf5e0e5393bac4fd8a63c4f7de9754882f79bc87cae2907e3062c00a8150ca9516fe58cdba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
474edc7b7990876b543f05d5d5914092

SHA1
884607d79cd87b2d9e366e71ffd6523e9acb967e

SHA256
10976e9d2f9c2168560bd4c18467612e044f97e53f1c4d192e6267c7a7776441

SHA512
9dbd3f4f575a1d998e9b5480e41279f27c7d0236cfaa307eeed32dcd6d4b5f631261c27bfbbf3243ace3c10afa4438a4e220956d922b713884f74b8704722956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43d62ad83cd5ee68ff1204f9c277c286

SHA1
0531ea53ebb37b33760f3d415c1053e93a804628

SHA256
8944df59127dc205b1d2906817df3e2939d76a0b6929e99ebb7e3b78b2b57503

SHA512
c87b7b5f58d4e7a9fd24cda3456e5a0b0fe2f290f0cd530729848daa205005b841d5a353126219cce8f8181b6885f03c077d27b8067620d2ddd8e9a81022e760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37bc66ae861db81a02a04ea8d2fcade8

SHA1
3777680d08b24a1d64eb0b73d776f9cadcf2f882

SHA256
890bde6224f953e3cd066497b08af9e24cddd0a5807ad1b3ca198beadec8ea85

SHA512
e9b8fb5d5ce2cf7cf2a512e5db44bcb1cc0642422e5b2d7d734e7f36236758ab875c76d8705a62eceed9c490bde409cb103a8bfe4899eeba36262c78842fcf0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c68eb2feffe368074f52acdaef51bf70

SHA1
03e7f54dd660e911d24500d8c4eb93cbc37764b7

SHA256
1be22ec3b10d70b3128009c20d9a23236f4aecae1b5bab58e5aa2e2f24248cff

SHA512
751389617ecf3fce23ece60ab7e66d59f3b13f71b2e389ff21df6674d45101f58f79c99f44141aa9c95f2d4173def1f33d935772b1f092bc96a06f25b743b1e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
204dc2acaf076b0e52e20000010374f3

SHA1
2dab93a30792221ab1bfb2c9abc300dac19a6e28

SHA256
f7a9c49bdea6c27454bac3f942dbc6cc02fe0beb44fc70ee6d64c08ed6f9f186

SHA512
2dee64342fd34f42bdaf388a0075ba71b231db558dd6bb3fa1849992d6867651a59c2b4bdf29c7e9b725fe6576d5c7eff69a7efd2ae8b85f34d88a5e4fb13a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2689ae181c79a38fa7ba734d915f6a39

SHA1
75a63af3eb7ff8f0ae974f66f9b7793193e02237

SHA256
6fd81ac005ecb15af86b53240cd28b199e31bb253be060d750e973b993b12ef6

SHA512
24eb0324550136efd12e0ae9ed6e15f71dbee09d81eed7b969accf123253cbdd34da6827708ad6e0227f7608ed8181859fd860f2f1aca25a905c1a5c5054a0c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a3ecaa1b004f55ff35f54869d9a28fd

SHA1
badfefff0338e50b7de64bc54f9b7a16f04df043

SHA256
1470473fe3ffee442e5e17d2641787c5614cb021425566f9a20677e42cae46a9

SHA512
42784ad46739a760ba530adcad0376992117bef584a98be867618fb083cbabc8b4103400dba7a3566fc8e9f9e71163bee6d851b3c4f366c8869dfa392f7ff11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb9e28088f4c17bc5b0fdf4ad944eca9

SHA1
478771610a8f7289412b513592c55fcf5e057de2

SHA256
c0161bbd9100cf0c9c0b39d66c9bda514a566d0530e1539a876a12c987a73340

SHA512
0e07b498b553f2cb37f60b63db7d1513a7838d64b24431e854cc28a5f4661cc406bd56dfd61f07bd2fa480d20e2cec54090ec26a06f6ee6f636a9fbf1ce3492f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc8a9ffc121aca1b49230564e8155f5e

SHA1
33fbe99b2fba3834a51635edf76a3cfb9962cdf8

SHA256
29de060ca41341dfb0c27b5b6a0949532c1c16f322c009bbc53dd217d17d033a

SHA512
1425f166d00455a6bbc37bcbb082fb37076e18e860d4721567582bcc1ad06a237b361695db1139fa44acf8d922c011f10d96bf7ff34a6626ba52ab639f5adb51

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE0DE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6FB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit