hxxp://2024-01-19_b66ded44745071548e980f5d119df1f9_cryptolocker

Analysis

max time kernel
137s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://2024-01-19_b66ded44745071548e980f5d119df1f9_cryptolocker

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ac0f8217e6fa30df9e1fd11c38b34e36102b2d044bc6058b393d1b186f611c3e000000000e800000000200002000000053480e484a067cc457498d5a895e6e81f47d5044900bd186d3d0f6e1d8c460452000000093a8ed2ca6c098229fa4a968a50fc1c5f23dbdf149f21b85af9637a923cad6ce400000008443479244c24962265c65f3ac32bcc696b037f196f331f2dc71cc55b8aa21fe9bcafffa166d27ebefaf60a51f7e915f62b91021dacee730462bc1c247d31821	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411815346"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0AFAA991-B6A6-11EE-A581-D2016227024C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d623e0b24ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000028cb4fccfe6ad834c3080142eeff94c9a92efa75cf639629f63636ebf51ad4bb000000000e8000000002000020000000346fafb75241f67ec4cf57556efc73a2a8db05f0ef6f156cdd72bd98377e347490000000b038696051cf23b70d21d2977e1c689b7d8cfb5b8bf9921340fee0dc0e99fb3c501d26ae44871bf37f1ff65157c8007d3697e157f21582d7ae68a0024e69d850d5e08f3c1d83cb2dac289f6d8b9a95029e62b15a5a8530f9db24e220507e60721b020ea4aa62f73352f60c6ac38ab8d65e0e71347cf8ce7115dd17be92b8ec6100c239d43b2330135786b8ddb931ac2c40000000bc664c36001275c51cb63b7b9f1fa6b9b1719bcaa808b8ba0b55285f981b4666316b44ab52bf1c85ec12500d75713442f38d2b97c808f4efc7f4a5e7247cf39a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2120	2372	iexplore.exe	28
PID 2372 wrote to memory of 2120	2372	iexplore.exe	28
PID 2372 wrote to memory of 2120	2372	iexplore.exe	28
PID 2372 wrote to memory of 2120	2372	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://2024-01-19_b66ded44745071548e980f5d119df1f9_cryptolocker
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61cdf3f88099ca242cd258ce0333b992

SHA1
6ebb9d49984b3e18c936121fef46d52983e8554b

SHA256
5f0932f03809d80874fb22748da3a1a95f52fb69516c1a437902a641bd48d975

SHA512
22058fc38c7712c86206f2f9e862212b8d6522c773532eabbc2516e7ae1facccc97b1105ad06bc3de6b0add5f97d14b6bd799d1a0f2c1a308a05bd3673692703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fdd2f648100231e6fd908f806d49196

SHA1
6a000b5aad2cefde2ca87d405ed9a402f3eb94ed

SHA256
59b21f9d2110a12e8d89564271f3051b08b0ee118918a11959551a856f240ad4

SHA512
1c19096db77bf432e4d37aa16546db5957ebe2ded4a1cb02b2187bc4f3147b588ac612b73d925f9969d1bb0d03c93b9c9ef59f7378044cde8463984de2a4106b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b07049778897ca6f7e0f7ce8d60e9fb

SHA1
e9a53f92feff7c87779884cc6d482e114bc83c0d

SHA256
cb09baf08c95c749d7aebe93ee69eacf036b35169a939e61489651246ef15c20

SHA512
2e7234234516a71f2b6005f88e0695b1c1a95012a1834ce5ea35c470401fc38d8a89c394ee9fdcd331fb30aa13db89dbe595f2e9a44984755b2e88dccefc29a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c708e90dea2772c4a2a21f6391329b1

SHA1
e516fe644edc07f215e2b5211841e1d38a130dfe

SHA256
ee552b691f6e016bbbfc9e63a0d0186d32dd9e5a6bb2378193a3d5e8cacd1a29

SHA512
f37dda093112ee8a2a22bf8234a46c0511280a4e0300b50cc654f9a466420a094bcca8561186b3adc52b672773c22614130bbedba4a49411ca8f76f9ce339bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b31896d39efeb5300d7e6f6b7dba9e7f

SHA1
96829f91318db569c23d69e1b9dbdc16c425bf45

SHA256
324ec3214345d62a8f5d15458a9d9b8958655de152319e9aed7e2dd7d2d1b7f0

SHA512
699ca4045bfe26f511508a7d3c1758649ee38528167b608d89dd63ecfdde7b8cc0245a68d9ad15b1bd5052a186dbb0b647d05508c966b513fcf6d72ad7a8d16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d135c57b8eed0cb5349d2061252b0936

SHA1
bdd657cf656385a47ba231f34817210328be58e0

SHA256
2544f630f0a84577239accdd5ba21081b61266cb0fc3f877cbf4e78ddca11af4

SHA512
848fb2a639ff48c5ee8d77a77e80a0f7be9ab7d7b67c9efd898c5447d6dfbdfd0ec93f5eef2250a3ac1c26753c97c02253be2536ea464aa5cc868c240beccfa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adfb1702262f775895c3dc55c472e214

SHA1
0d1c2da7a12cf67f8a8336bbf2b1f6ed2c038165

SHA256
12714724e0214a8eaf00296bc702f546a1c3940ba59dd68a6fe3c8b39bac2f8b

SHA512
4bcf6662842637607161e89ecd5bc1638f1f419c682270ee00e42440ccf20a35b1eba0e7c069fc0a35caa6fdd1133fccfcc8d823bf13cc599a995ce7362b68c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd1afb68d9489c65ca991c5af60cdda8

SHA1
26e5a4fe6a3aafbdf58c0fe46b588f8d75fb7c29

SHA256
ffaf69286a33bb695e86d5a9628cc7ee033fae5d15105300cc79ae084d8ea533

SHA512
94706a2cea84c8c2c6fac4034361d00488dc92d96d0432f4206242abe9248c9f876c72036e65df8bd0238d8270bd28d2ed6ec63d2c9887fe58cd29b4787759b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e342212e329a6255594f77a6f51ca104

SHA1
b5554c46c95ca4dea2316d06f3bed281cd418611

SHA256
7d3d7c561ebb4e3f56b5e6ee6cf2453e985ed830b4f5ad94e328c9ac5e784a80

SHA512
6853782ad2fcc205d6a9e057887a6ef7c6e3930e99950d1e37c752b4ea63ce72316cba4001a932bd82b0c223aec806307c9a317d6c365ee39e5f1c0ff2d248d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab45CA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar464C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit