f3613f5434d874490f600424a5c226cb36de3d8ce41a319f9321f4f845501ae0

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/www.china-pub.com.html
Size

3B
MD5

37705de0752d1027f8fc3b3f390c448d
SHA1

b9a36fe59d4092c1e8363b6dbb80c4325170ebb9
SHA256

b8d52dc3f650996a66e32d4fd4f40129f6d5f742a20893615fe1b8dbedac6039
SHA512

affe90e227dd7fed7ac0d9dfcd7a01dda8d7abb454e23a4d98fd7c1c4f8f38bcc7f6062cb52cbca3ac7088ee55900a5b85810e2d258b6896528d8cac87dd4709

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e6a19fccd2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000001f6d0b819a9bb2084149f87ca01b606eeefe32ab68d22b04484941f99512077b000000000e80000000020000200000001a3d9768dc3ee52177dfa69353e7b19b5fd0516b1be16a4d872b7840ed0b668c90000000a14fa015c4762cb7a4dbd926e8c0c5223602652dddd9f49b477c69bfea1987af905bfdfb29c86a2b5182e314c71c3a0c74782c93f00224d3d8b610babdc00cdec4b2779300f3ee4d316274bedc36e318ffbe542ec0626046e4206fae03e408a2aee4e9839d28a03b5ec03d03f87917ac03d78b3e45555df30b7d6f28d6a3a572c66814fec05befb6a4bbac157c5f8c7540000000d761c53a5ce3ddbd95289b317c51fbfcf34ae1722957398c64dcdf61cb75b4bd49e882a22d326122cafa7c99ddad425818bd33b62738623599e5f15500c41a3f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB1511B1-3EBF-11EF-86AA-DE81EF03C4D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000c5af7776e7926b8e2b74655ce5bfe486f13904eafb3b103cc47ab30c44b9fcb6000000000e80000000020000200000002d1d1233d42eda45d03eac44f4ea6071c7fdb40dc5b6cb9c2700a09f85ce1d6c20000000a88e34122509a158afeb3815e4c9ee8b7e8d7985efc42a1c7fba28a898abbe0140000000a74c372d93cc8704291f50b587505b314cf83b431b72e12dc14092f2fe0936419d08aa2c81fc99a851983a807d52d89d4a99f9c3b8230240336656996723ec24	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426779762"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2060	2024	iexplore.exe	30
PID 2024 wrote to memory of 2060	2024	iexplore.exe	30
PID 2024 wrote to memory of 2060	2024	iexplore.exe	30
PID 2024 wrote to memory of 2060	2024	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\www.china-pub.com.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a6911dca331d872c9f7cd4a0069de97

SHA1
e7c8c424eb13155c0ecf83a0df99afa986ec5de3

SHA256
3a87895ec29ac3aaa60e07b833e22a490eb8e710286501d58b166fe7933a0e36

SHA512
2699d89d70a563de59ba79feef3771ebf86ef1fa767579e6599f4952c0e1d907b0f0731ad168a118990b7d66e08c71cc3e703b5c4a9f249ca38cd7dbafc93c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abc61e68dd8432ac9bd6bb612594ff0d

SHA1
214b5c89567cc858768c17861eaafc16a4e205a5

SHA256
c29e9f2494425b2ffed5c3be1ffeca6c43028e5f65551e9fcd0911c383ce5241

SHA512
32d5148fe6bad3c3096fdf499a0a3f8e6723eb8c2a346f998b03f2038bb807a42204ac01f9cdf15f3d5a2ce35ab1b6abe4279b16bc4ab103892c50050228337a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4fdac42a6a0f3cf9e62db3a55483f29

SHA1
355f09934586a51421e74c3065c74f289eac14e8

SHA256
baa94331d27bd207657834240093ef2b6596bc4e9183e22af2591cd58e0cb10a

SHA512
6e10927cc10da300e7539319bdd1eaa6191b0ceafc29b7e2544f041113e9bb2380148f4ab7ff4229445c73c8df7b5875d611e6ca895a40500325433faaf14c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93fcf4100d2fe53d49666992322457f5

SHA1
28bc3940ef4d19b801afd985be5196965627551a

SHA256
157cf1c4ae2c593c591da802603cb38eca59e227c6a6118767e439443d6e5858

SHA512
7ab9425752987322afd875b120ef1cea14fc509829b91187afeb8edbd2c20f90700acb2ed3da392bcf647d670e77bac494a22ccf5ff2adb9870520508c84bb9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3da17b0cbe2cade881501c29a104c0c7

SHA1
cfd1a5b6358b7b4403bc0adafc4207c2d84974c1

SHA256
23cc50a5c214e2b632f4c3475c5f18f83f4f3d45e0bc0a6cfe68fae26140324e

SHA512
bebf69a1ad8cb019f1bc027c26a03e46589b89b644a764d09d61fbdb0c86855b394c2b7205ef7f3feae2c8d2746b8980eac2d6bfe6f4968f53b763f54ba205be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27bfb7795e3118a8fe1bbcf595114737

SHA1
d3a983deda8c271991e40c9482253a03cfa01f56

SHA256
fecfe5394e38965d3aedda8995b1afc4ae54f052af7dbe44d96d35c1baee537d

SHA512
f34b612a783cfedcef11fc07dc4fa887fdff3d861974ff9c0a5beb40a9f213f2f290a07f04381a8d0005bc800e6af44dc38c7e6a0e75628568e2dbbc6a6cf6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4524b1879df68a512ad8d46fee06ae10

SHA1
f247102591da49eab54dfaa436f85e99a7feced1

SHA256
591f8fe743788a8080322a75a6a9c9b0a18897ce0386c9a4e27ab529a666c7ac

SHA512
26fdadb43f497eb8590733e3ccc98a5c454f6f56d11889af24eb436d857edf2e6a8a3f07f2a4e912afd9a47f9d93ca43daf5fc2aaf2a39635ee06fc1a8130075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cc9e8adff0726fc679363e416635053

SHA1
18619e5aa410552acf43f657a5333ace9287d659

SHA256
4e087d030ef3f58fd395b5b893e5e9132fd509417a8b47ba43f4247a4afbf370

SHA512
10ca256228c9d897277f13e4f703f0791c8aac0f6d50f350f5bb44418007b2cfbbaf3fd9d09b669f563c90ab130f4db64ac65ad88fd6a33d48070d6581816f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9c4679bd4bdd52d125bbd980fbd6d29

SHA1
571fbb1fc814e383455662d1ed69a575c7f26dd4

SHA256
ab3c30dd07bd3e11ff413e2a4b3cde538a762656dffcc554a1e1cff8cdee9436

SHA512
32607bbee04bf5c1a2d4225a407e1feceb92b95bc5d0c5a0757f3d93bc9576df71e8854113abfefbd413809e5d137392525ab4313127663ca6d00e1cc2a8f429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b23857ec4384b6170ebb64533a23138

SHA1
21220de09e5d04d13c192c790eb9dfdc823c9f10

SHA256
da8ab2ab2839d4ef94c28c85ead429043571e609d49889ca4d2097de2aaa2c1a

SHA512
72d22874698d456c5a9174bb4fb31bcb95d1069aca6f08cf61b66bd0e1620dd7c36dcfef2c4f8dedd78802c4549d34448616973b1e3c0e62cdd6273d5c6762b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b2eb00a4e130528aad37266f7ae2e53

SHA1
e2016925e4b0ece4115f1d541d88e655ca70c5fa

SHA256
c4f6fa31e3fd1d9d79e31f135e8e211d320ffae0147bf994c4185d9d9047e81c

SHA512
66261c3a76484c3d2a978d9f7dc5bf9c1050d2307f1c292d6db5a1cf6d3b37286c9a4427b377034cb07e03a48550b484bda65c1902bfc9318997e50fc78ebade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2d7a04967f94cb3ca73b13b9ac5343f

SHA1
a5241defc4e64ea2f883f356194177c97404dae8

SHA256
7ef7c56e19d55c27d608535fc39aa072589d140609c77b14a16219cd614cfece

SHA512
30483dd03551107a0790208a2e446b8ba3b8fc4017b1fe886f9de39acde31e6a4fd3c4f825dfb38a2ebf532ab52e83cea50ccad49a5c2bf090d988c92658c2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc76e83637954509e0e9138abc679583

SHA1
f74fd097c00636f83a48ab17be32e37d79048f90

SHA256
12085c4b512844cb138edf181b5832e5eed58426b9677c9f9fe465079d7f1a86

SHA512
62c2fd5c7979059c460cd1523bfda4a0dab2c4b0bd9979e39201f5806955912e065e7b0eef097953377846c988f294690a5cbad8e29feb98d4d5a89e8008adc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30d08786e1a4cd0c97d9da3b469fb56d

SHA1
e0756f7c257a9ff0097713c4b1b80c2e55c0e0f8

SHA256
05aa2806c80e1d207016ef17020c7fad82cd01b2206c9dbed5e3602ca0d05f17

SHA512
f73b8c03f1a443e614d22638d9ee9b1cc9460c2096d31f210e2685a3a1b14ec834fe27a324234eb678261ce238c0251f8f336680e8d7f71fd78ad7b158e311c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a93bf0cbd7dd5aa4d455ec2329c35af

SHA1
51fa7c065e1e354a2f5a1b8cb0d2b2e86d52100d

SHA256
9ef41b13193eeb434704ae6854b20282f540653e913c6306498bc5be42da4d65

SHA512
18775f91ba9f41801e604247c523315c1df79bdc251ff2b1a98afad5d52f786c1a30afcfcf5cd56528189f58b4c14bd5fd8a50ee32da9779f6f4b418ee2ca8bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff6a2b895b2401a6fdd21a9e7ba52461

SHA1
524f1296f19cb9d8e121adb940fad962957e151f

SHA256
a1ab72d443cdc20403a5133d07ecf2f3f366b383104ad61d46c05d6920d20ab9

SHA512
5470e0b3f499b92fd64cc648e1ca37470bc59be8e642a0101403cb821a9ac76c19bdf25b9ad69a18c5f3be5b1847e84bdfc28173c1a308c84a70d3231b44f00d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE708.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE778.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit