hxxp://2024-01-19_560317efbfdc5830d0f3cd42608b5492_virlock

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://2024-01-19_560317efbfdc5830d0f3cd42608b5492_virlock

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000002f724172ea24cbf7f3bda195930842479b8b4a9c7fd245deb48a1b1ebcb31e2e000000000e80000000020000200000000715fcd151a4ce35c85532bd4ee6327c755a29ef568c54dd6287b6485c7f585120000000a1571319e4e4ea1363fb0a5f3c107a766ccf4545996a1cd1206e170737dd07e04000000068612a5bcf025b3802d16b6b95620a67f40495e05e621e5c42e6d89030ee631cd038953ea1dce1d24cd756e0ea41065053b37f5ec5fc7797097107cc29d17b73	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b0e3c8b24ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3CBD141-B6A5-11EE-BE57-56B3956C75C7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411815309"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000001a4718e1b1f077625849fb3369ac5ad56614070f581ce9b22bf4800df753a8e0000000000e8000000002000020000000c198a095f2398134b6d153576a4eaf3e7e4c69aeca5a087912a5b379d67578889000000000f99ef95b94c2f64d3ccd58a773c74ed770d6ab60ef248be0490b6462a7008e897b834d492b5461478c20637bd7bbde3e3e37a31c46db5f44a6a534a5cb1a54c09ac5d2aa13f34f1094545865c499ec7209f789e79202e4816257a6215c69c5575e57cf3196446e2a546efcf098a80520f828ad93947c0c1b24d59d76264cd895dab7f8d9590c13597497b1c987785c400000004f85d8c6a78fd62b5776486b4caf63c792cf990393af150b9b2b544a221eba2d66eb0b4931c90fcd39f676d26486e3d8af89c7055832dff7653f6bd9e51f0996	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2824	2236	iexplore.exe	16
PID 2236 wrote to memory of 2824	2236	iexplore.exe	16
PID 2236 wrote to memory of 2824	2236	iexplore.exe	16
PID 2236 wrote to memory of 2824	2236	iexplore.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://2024-01-19_560317efbfdc5830d0f3cd42608b5492_virlock
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0ca6fc8c2e47a2130f734d392de0c6b

SHA1
49b4cf0a5fe3dd68b864d44654305470fe2d65b6

SHA256
2c824dbfe38d6f47aeba19405c37b445e8234e0eb055e7c46ccc05c169c393f5

SHA512
601f9ff439452e0afe25a60d86f1cf1a8e9f30aed3b866ede81aa5ea7c193ffeefeb0497a285961c60e912f03df49d6fd4a796faa63e3d71736a021ff45f4af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1e56cc69788b9fca02da24617c1384b

SHA1
4b0d6d53fde85a7c0250015ba42539319d535fb5

SHA256
0c520f63632f4837d7f4519f1a3b002d8795c54b830fb4194283f69b9f3e056c

SHA512
b8120b89d10b230f6d7bb0246cc31c4b4e679bb87175d4e1385274e7d41b86ebc758260d20b2dfa7cb32ed06688aaf5fe32f9c91f17cd560844b2c0e03f76873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07d2ebe64f86f3a6ebcc606b9b7ab51c

SHA1
4bfc99e0e80b42934aedf51d26d73e2833499104

SHA256
d57573d385c61fd59a04029c4e36816055f0677503429d2b12a8a926b57693dc

SHA512
5318a864e92ad2d51e415ecea0ad16b263b14ff3e149ae11710fc43025636e47aeaea041685f827d4a4924c81a86877e0e86a268c62af4a882e23bb5bf71fc85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29bc6fca819aa270cfb01fa96959a2aa

SHA1
6fded7b0506ac30524a8f7d276e1d4e49ec67704

SHA256
7336aa32a9ce7e10dfe29ba871cfd8133465f9e528124d829d30b59d7367c333

SHA512
84a95d26474c3988a4666012e970110fdb283a25cfea3513a1bf1b568be917492b6d8f36c76e8eddcacc5d13f9e87b5b9768dffa2f89613859a8c04fc89fec3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7baf60ec63e5259d7ddb2208271ccbe1

SHA1
a4db09b540155ae21613c7d252acda509bb6339e

SHA256
ca972d02f302eb137b47a860424f04abf0525a3a9bd4c0a1240edc747724aec7

SHA512
93660a03d92b75faf3893dcc39f1800eae86c77a873f1015badfe9c560bffbf34b3e7076067b1d331f521b827ce3f364f28c09bb41f665d412f2ed8c8475d9bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a7449356fd7f3b26b9c18ecf5df81b

SHA1
05f30973b9c3bdb83b6688a4f7278f4823c89a2e

SHA256
792461334af2a4a025c1184f9fcfcd5231e438999636e6f68b2f44f42243a4cb

SHA512
241458af8530f0d5260a105b47e3ad6a7851b930c1afaea65842b15997ab04d6d48c5bd805cb0b6758929e0936aaac087b04ff85e795ce4fe844f3a7ca2ddfa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3ae0e378b70934465cd764e7b1c987b

SHA1
d29f350a9823d15f61fa1b5b60412ac1f56394c1

SHA256
458283a9034fb669600f05a172d66373116dbd7e9b6746e55673b01f1f40b9b9

SHA512
faf6281acd04b177d65e00962cb576e3ea4a31dbe6b5d289086330ae1dc91b016fb5f455d69bc181d1710bc17aa01125d3d5e2993d98419e1ea315aa437bdff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34d89d5085d782e9a79eb7d78ee81d6c

SHA1
a3c41de95f1a525458abd6efb5bc7f738a1826ae

SHA256
cf35f81ed05b50fdd8ebcb1a439632c1578ec9628f90eb826822cb5d977ee4f7

SHA512
1c0c995a4258a30e5529bb118462a9f67e412876af57db04298ee9c5d4c96c9c311566a9e16055f705221ace2fc1a59071fb4fbb59ed25262f7820368e5679ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cff29d2638c18d888592e61e30f95add

SHA1
e9d2078a693c9e51d7829ecf1598b67ce01d937a

SHA256
873225538c1d5898072f540f13d272bf066be3d2407714800c8017accfa7bd33

SHA512
169fd06839b8a26c3ae8fb1ec98a2dee5c055235896f325c03692a95de889bdbf087c4f3090db74ab18b2efb9eb4acfbda01d051495825a7a95be8b89b6d3210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27643bb0eea4faa87c6011323c8f6504

SHA1
a0da80594025018a330eb415f143ebe7df216d25

SHA256
4beb1cdaf769c981c4b49fadb7b5488c97ead82187e1939365fb169851e95400

SHA512
308d4df9137a313f084a0e95e881b0c17bf6f28f27c898a065e6e6c6897f7d72adb2ee1555b9761202ef6d3b48b381b810d7e7e8fb9b55f2cbf4646dd08d3df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78436f72b13b12b46ab6d4685304e371

SHA1
cac048daa52d39f4b0e550f58c28ebe30106d1db

SHA256
fd8ab409abd3b76181f25e21b6473fba35b7e20a18a1a96b2ff730b06e8de95a

SHA512
6347f1c917feaa7d8986b2961ac99d72acb3a7b561f0cdd931084f25a30424db4197787049e61a6d6612dde7437db4821b7521aa1d25dc74c5440fad2cddbf1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0469698e16b376a4d02e40aa0569a30d

SHA1
abfdfaa0fb2a0e300451a0242599ae2085426b70

SHA256
23779cac1d2790064a316f4024a97be08011f39dbf9de6548bd0122edca8de1a

SHA512
d2183528cfa2f439cd6f6aa763bae6d4341b6156b3294b6745ce3d61cef9fece5b2436ab6951adc382815d2a69d35527cb4f6dafb1ab4f318468363e57adb92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fadc4e003a17419544322f13cd81c44d

SHA1
fa9587e278d26d68ba80263065eec8f1e124280a

SHA256
7ae6ff39bb23f35ec60dc8a4241d92e9d7f8cd8c28f417b78c08f183d6ca85c9

SHA512
a11c78d80bc32fb44b5d3e550065ed71eb23752540bfe4f8d1a7eabb8dafa4bcef62bbb1a17bb9131d488f56112799b19880d7408b9cd1cf2c767cbf10a54f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6FB7.tmp

Filesize
20KB

MD5
4217bd445506dcd0ffb7a4aeee1851c8

SHA1
4625c10903a53630af8cb676d9a3107a1d0868fe

SHA256
32d03df7e523c953d45b2e79fc0f7ab182310d02f5377afd777fc66aaf60629d

SHA512
0e57d35bbf1e978337b631caa96a02656b72cfba1c8856f744721cfaf3e6e280f7077adc9d9f3ad1ac86160d078dccbe603cf1b565ecc2e8fa9e1c4f174de321

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6FC9.tmp

Filesize
1KB

MD5
fa527dcd6b5eb05e72fc51570a2a6608

SHA1
3380c5ef74408265fba2f67e790636d0ad0a51cc

SHA256
4dc7a4a6cb3be2c334a27a49df89f18f8f91749fe6aa1cf28d548e0e0c75ce3d

SHA512
05c0e217c433949cab210102a26ca7f6a765515b228b217e25c7409408fc167b5a59a8494e1181284e9ec72849c90288f3a066faa284e29d871097ec76291a5a

Download Submit