f3613f5434d874490f600424a5c226cb36de3d8ce41a319f9321f4f845501ae0

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/index.html
Size

1B
MD5

c4ca4238a0b923820dcc509a6f75849b
SHA1

356a192b7913b04c54574d18c28d46e6395428ab
SHA256

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512

4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B87E95D1-3EBF-11EF-A037-6A4552514C55} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426779730"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06d048dccd2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000005b24e5bf60f0199f1b5d66d031cec05c5b289c2a18916f6b01e7fd08f096328f000000000e80000000020000200000001ab52f7b288a9df275ede7efed07e5ae998fc3bfa1a7c5dc64bd92b23fdb607e90000000aa218b8ed13f5c307581d470894063f54605393a55a5a8c748235e71417ec7a1aa57a5eb4d61555279815b169b66fad7cedcddf2ce226121a0fd083221807e4679941961332d50093253470b293359c47014ca9208b8d26fc578ad3e33afb53f3570fbb988c9eef47a4341b64dbd6a911bdedd347a4cbd7ec8ba81d417ce6fe588308864d4eb9b2066a2a70592b8868e4000000090e05e9e48b9bf3f47db0a75f91855e5b699ef7bbfae2455505a84b0fecd9fe2bffc95b73e918fdb3a2f8be84e995dcadabc1a779879ee672ec9dc9645b6bcdb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000004a64ae7132477783c898fa38a4f57c4550a4695cecff585bc0c90f130ea31aaa000000000e800000000200002000000069c8a9da9c69bd5bd12ada6469621eedb597945a09e088c754e1499ccc8a8650200000006b8a14b9b6d4ff79cf4c9f3cecc8e3b45e3b7f303f22ff1285f6b79c3b4f151140000000929bdb6560a670d8364d3617d9ac2ade68baf81e2d35f50c44f045fdf11ec75491a0700aeae62851f345060a4ca28f93bee23be67630ba266adc8d1dc5333060	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1620	iexplore.exe
1620	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1632	1620	iexplore.exe	30
PID 1620 wrote to memory of 1632	1620	iexplore.exe	30
PID 1620 wrote to memory of 1632	1620	iexplore.exe	30
PID 1620 wrote to memory of 1632	1620	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dac5e923ae95142a4105550b20e05b18

SHA1
9cd4d1254ba3264c7653ff9965b6ee6d7b103a35

SHA256
f2acb131393ed6af94a91c362b8f5bccd93aa38943fc299ecf177bd52a8b57cb

SHA512
c6b39aa4286874d7faa43409245b12cb6bef0b5d590f2df350091e52fc86d5a6c2fe0ee4e20d3581ee5b5baa2f665e03feaea7026802affad6d60374c1d01559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d4c09314e7910bbfcf554288c0c887b

SHA1
4b6fa7d04c131224f76b5e452cbb150f60870745

SHA256
478f95e605636f758cb127a10ed66f7166c5908c898183684f25c231b26645fc

SHA512
c70ab070c2e8e145060063b597fcb14da368b9e98d70370a6f6adc75ba7301d182d06252017e9e58890b545bee655f20143a86885fe6cd85c32cf4cc52560f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77d0fe76844bad656cf01845ec682b39

SHA1
2ec7bb621d9acdd8c67ab1dac76eb1a5f527b6ce

SHA256
4104a204b49f083c88c7b218a9cddbb245f2a71dd8170be0f25cf18cd0bc891e

SHA512
9fa5e4e2ba6a3b99e90910f0ed1c29f5334ec482e07ef918cf98311ae7bb905fa65125a5fcd907b10aec689eddf4cf16f7324c772771e1aad08517288d7ae77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d49a6c8ff52dd9d410ded6c3139c81

SHA1
df78fe8abde998f013c790080c54feb5bb73cbe3

SHA256
8ff60045a89f5ec020392d689293bdef2e0e30fbececd5d0f8df9c596e2789cb

SHA512
66f6ecbb6b3cd73e052c50b0ce86548980dce7dc3f6958866777999b7d089897c8b8f3d944638e69921b85fb5f55d569d60f42d5cf4e09a4d563423362cf94ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
809fbdc774aae1b33c5318223aafcb6f

SHA1
6a3b056327103bbcaf626f429b988bde49c54a17

SHA256
aed260d619e849290032547d458ef2b8483889bf899471922eb6f76b58310223

SHA512
de1b7461331b4d8286bf59fe7f1e1c38097d5c8bf9c6f663b78cda8aeeb1ac932f1e99b8b2b046d37e26c5cc0f128a2f7bba3f2fb2d5f321493c745a911b82bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4491f53d7caa00a9849555398dccbe6b

SHA1
f9fa1e322f01532d7dbd81e65e1da0800b8b861c

SHA256
302f4d8d3f4c24bfa6da654903c8e2ba82bc5bc6f47995962e3cc7f0c38034d5

SHA512
2a2ade342246891a36028f2252bea37af297b03c962ca506c3d3a3cacf24bf1ef43eda0a6b86426ca9c563b7c85136c18a11026e2415a9d480b2170d9c5d5f1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30fb591d60d799846e4cf2c8cc86a5ac

SHA1
b8054511ca5c6acba63ecf93b301a1ed93d2d12a

SHA256
b7fef12869e372061f0bfc790557fd1d6ebaa872a854aba0297f0184d0548f5a

SHA512
3f25a8e6474ef55016bd60b7442ea28460a417754b8c136096bdf2b20ea13099e6162930b553233fc2e98dbd14c93a3d6f906c1a6f7c5a5162068369f5b9de11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ae9f16904a6d115f3f16719109ec10e

SHA1
7d2e2028349e3a5385d26ca36d44f26e229aa39a

SHA256
8babf2600152bf3d2dda04b95db982119ea0e28fa720d00c1ea3a06ba530111e

SHA512
30951bcf69f27b0743b2cf990fd3472a031309f5db3a906b3b5620e1f48b7e313fd3fe7d458b83526b7fe17b0036eee6c107634c4bfe073b744b466f495009ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a84b7d5f50a65a6cf619e6c7b9d480a

SHA1
852e8f307ab569981d63d23997acae40c580518c

SHA256
1032c6fe1ebcc0d42321c0aadcba665f9a633b5d24ec85d045144dfc35bc69e0

SHA512
cd72ad22698eee323980555d8d5154cbe0f08ec479c108700b5f90dbdfc9fd66b8c5f496cf2571bf672f2722e95eab4a1f4309b186291d46fe7b206034588d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0ad3fae17f7ca288dbd6ecc8ca701e7

SHA1
29d4fe97657d39f6d7e938a61e84d46ce3e7c8a8

SHA256
65304a693e0e775c08d1e6347186b461d35cfbc09e5afdaae90bbd790a66ac00

SHA512
4b46e38fc0cc76ad4c79bee5a4c216677425f6971c92704095c720f6de3d78ca0ffee1072a1eaac2222640d839a34a37bda7659641e001ce8e928034a9f09649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e8087d0586be3a5b20840636d2e4957

SHA1
c844096ff2fca0a30d778cddba36ad364a579354

SHA256
6ca894d690c3b72ab7e94444300df524c7b2593d0c215f059cf4777b62435db1

SHA512
5b1094465eb2a5823d08c1054bbd070395c4cb9733c346d852aed7df1cc6952623301c7ccbb2e760b2be5026fc8d7a9eed86239da07e6b46abc9c960628644b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2c5a47ac3830ca83a657ec82ca6904

SHA1
fb1d5c99d6a95dd28f6a77be412462a44c574808

SHA256
0da14d5f41c46ec8339158c98b2b9ac8601e9a0f93b8f2c03a5b566eb95612f0

SHA512
7248bab45a0b9ef0584e41a4adadd52a989a85b4d11fe3c138210d688242a0b75576ab1e884ddba9db8b215f9ce27310705f98df5a4c85f6e9bf6698899a0333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43d6c7f8589816c2d559f62b52a722ac

SHA1
18d88c56e429f9fbe22e7046e166ffe8fe402e29

SHA256
820356e496d1079b53a58edafe9ac41127df51bcf8ae1efc6b861ed1e74efd6f

SHA512
aa13b30110277f4fbd89836eecc1981bd6df2e1f796bd828637eefbca96cf26c6381676da5e77706daabe3edf0f2e6cf342b34797aea5417697c469c23cab1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5898a2058a0d98099e95bcc3b4e3b0d3

SHA1
e346efe8bea7dafe780a270f3a4e482137e06333

SHA256
c94ad23e713cd27beb5edb55092a86dcf1c6bb494acad87fcfdb2bc4ba1ab878

SHA512
accfd34d482ae699610f006c06950c3663adaddef4cff70179d7dd7df6eedc3d0970119900ede117fc9f015b1de698a22f1cc8325beef47c42034d2dbfdbee9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d7013409013e6262590c6a908a32c4

SHA1
d6f2b44576c071866af769931ccad97994775820

SHA256
4598d4349a1c29018e35e3681134df3c9d148fb3c00bd049854d56bd206a1890

SHA512
1d3cbaab91cd18709e22abee604c6391bd5a702e3e3d6e058b8e4e73cf74e824bf6abcf4ec2065a6202ac6a5f04335d29347269705af3b502d02bd7e3d4be630

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2475.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24D5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit