e1e69f5eb3d6533bb0444e04c8cf2f2866606c2a1072b2a1231ced158d397c28

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/www.360buy.com.html
Size

2B
MD5

9b35dd1fd8fb2e8ba4a972122aca50b4
SHA1

3e7f8dfde6fdfbe8ac9722e701cef405a9236330
SHA256

eef2eae2699d81c58d176a9a58d4bf183df2acb6844b9eebf1cc60ae460ec50d
SHA512

dc7fb0400a439e7de8f851e28c48951459483089398ce3be6596f0abb8545f27b0b35eb901e9a3ccb7177e70fbb19276d4f885258089e8b4ddfa2e10facc3c1d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000057ba8ad4bcb27683574b942d8b7de19c4b7ef5417e6bcc643223b24cd2f9bb92000000000e80000000020000200000005cd89ce22cc99e2741e2760beab9c225a61a3355e8742a2cb6cf4e359a6a844820000000672974d74c3689829ff5d6b007f2d293936040c1330e4dd23cfdef9e08b0f5fa40000000664d20de43c0c29a14144e632b4c9dcd3cbe3b53ea4cd67d38479450059245b459e5cd270991728c0c05bf50a781103a31586dbd1b0b17a4f75d52fde644070f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE7040A1-5BCD-11EF-A1FD-CAD9DE6C860B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b0a58b10daf23d152aeb33106e18c11d4df29a18389c7b00234e4ab0b05e9524000000000e80000000020000200000008a9eeb0788b23978bdeb457c5a844433bf70793b02a09efe6ee7aae03c0783a990000000f68a90327e9509af7c6c1830095223dd6916d2961be2ad3c9a887fb940b469e20526f94957e40df4f4e6ea3bf6e0237a432920e68ef27b6a8d797137a0ccc57e6b9b07f5146c7d9e65553056c028b02a9f7af8adea1bcc1ccdc7ca72a1099efed4acd679cdfe2ef09e0bf84ed236457d5b5bee51fd8085db56f8cbef74984b8e507226201ffe15855c86047d02537f29400000001847e8f4e659f9481dd17b84f440cc4260d9e9592831710651a1f9033ff0cd67259b3bace8db7108412b3ecdbb8a73071900405ae26d6c59f2cac26de593491d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429974417"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e4ffc2daefda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2448	2096	iexplore.exe	31
PID 2096 wrote to memory of 2448	2096	iexplore.exe	31
PID 2096 wrote to memory of 2448	2096	iexplore.exe	31
PID 2096 wrote to memory of 2448	2096	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\www.360buy.com.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4bf797261b7b02ce50352f5a1a41c8a

SHA1
944fbb483602d6a6dd64815cd996878b8a176ec7

SHA256
23c1192104b536633575b354d6c21882109eac872efbb0f48925989285580cbd

SHA512
bc45b4fd3bb39feb4d7b1146be46b0170a7524c13366bccfc4a9ecf6f8f40104da7203acfeac745f0dece4c4d293ec0ed7a468dd6515954a94b063e56133e278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
637b9b72603e508bddeb771e998ebf99

SHA1
72d4d7c407cdb5812b2c4ba1b48ee26b0a206391

SHA256
79fc5cf3e271fd2902f76676698792e76485fc518617d6980bcbad9d7c7c51aa

SHA512
b75df5854436796a0acf3cc70f1c0e6c7a62fcac2d38e179905bd60203c33fb23c992be0da96fff791cb975ef38793277b6afa629359c46de68a880be5ec64af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba64e7e820a8df866871790d362e872

SHA1
3f806db9b1539da9e7387ed304c5d620c8545c76

SHA256
774ecd2c6cf2e996d8a0835de0bec1c2887eb824902bed1b4eead025d9459444

SHA512
850c9f0058eeb07f7d50e95a5915c388c7aa2c97f25a9cc7ef11da17823ce6b38eb9cb68e689a95e77312847787c5c0f318b6fca496f49724c568c666ce56348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d086b1d0bd4ea82c777585fb1e7290c

SHA1
115cdfb0f8d5863538838ab6f062b91cfd7ffe05

SHA256
ef89618295a88f60760256a8acdf2ad15c0fdc5d1cfb44278d56d7dd9d3511a6

SHA512
5d9c90c749328800729e98f6a1167016cea2d67bcda843c3e9a373a738293f3217d024cf2b91c7fffe3284e8b24c680981d447050c3b2546afb0836409ea0abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffa46a74423dda23d55a8e25f34ff8cb

SHA1
ff737b92236d30b0c02e8aba526d8b008b2666fe

SHA256
275e63d64e2b8716674ae415aba66dc70d96639996526aabff7a3a4b28252f5c

SHA512
021e9bdac2ef1fde495fa9f9ab22be04363bafc9fef1c085ae44936d169bc1b23063977fa17212814a209ddef0f5cc9208cdc9dc8238520aa4b6ae05d1b98ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
967f8f8091d2cd42be0a2684f05f949a

SHA1
5f360205469d83daedc40b03a3cec09fdd470530

SHA256
917f1ed9fabbc29b2b8c928f77f612ab3a96910647a760adf412529cf5cf743d

SHA512
21ae8772a04493677eda38a663ea97bf21b39467f71ce85398ed40726e39b0fb85057fad031fe13294bb0db1b11bf2125c60c1512954ec4ae612142757467eb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbd0f7ef9a22cd42e26018983340532f

SHA1
805c19358a2abfc1e1b9118ae174ffb12ae894d8

SHA256
8ea0cc6af6b6c1afaef9ed2fb60ac79fb4f9bc985abd307cbbb47b0a267a9ae0

SHA512
f6eb6db1513d39a810ec0ea2908de57577c11eb1e58b111767cbc0269945e775324c5dd50cb6c0b076b5222f06012a70b3216ae1c2441c337c160d06bff0e761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f707c6a3adad9aeaf32a2ceb10e4d0b3

SHA1
dda3afa85ff8007d006e8d6b3c31ef283280c474

SHA256
e00be5e5e5840661f26d7da197885325eeaeca271ef3e7365540c1b461c589b6

SHA512
968b0fc3a3b5bdd008462078253981e54da429cbb75dd1a011d39817759093a1bf93013cb61c79f028c9ed5a5b18f640f7240524de4425235f1d5792fb09edc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14135cdc716707895915be1b36586f4a

SHA1
1c751ecfd881093cce18bc86d23b9143318a8330

SHA256
7b4e4f412e533fd8ca4e380b5ac4fcdd87022ee6d93001d0cf696cc4c7e62eaf

SHA512
7084f80768922b06c8a595230a6b3ee122557541c0d3efaac6cf1c6b6e68b61395fa769c0ebbc3f0b3443b7353a38a4a0d474fecb180284446928889d2ea11b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
def4fb1ab89f1b94d0bfd453dbd85b1a

SHA1
3554c7a71bbcf4acef031bd8d550f412e16349f5

SHA256
f4f861742fd35c0caddff75466a4758f604f6c0b3adfa1876fdc1f5404d60546

SHA512
496b3dba5636e07b1afb2a2b63122f848f59a8e06a728ea159119331ecd1d2c2c2b944f41d5f752b9ac64c04d8b5cd3a952ca8780c3fe3fea569862bef65a1d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b5e0adbcd2bb0dae47dfd4d7f48a6a7

SHA1
a36d45b5e9ede34934ba68b9256e63d2fc4741d5

SHA256
a0ee6956b245735e4a47d253e6108a59eb6a160af14120df1cdc554664379441

SHA512
3118f29b258ef0ab818d1e9f27626d54bd6d029772425252ee3c39fdf1dcf8da22e09560299de7fd9e821560f36d89fd9a1eaa1545b4deaad13530ca34749607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47c3197266777dad475f956271dc2a6f

SHA1
c3f93a32136543ffcd4b6f427dcab1df6a6db726

SHA256
46bbcf408e8bfe1ec831c24e0943a6f2af76a6884f34a6cac57a75e432fd96ca

SHA512
58090727ee83feb4f27144308b10670ae857a4ded07d5458efe902a2cf16b3400bf38730e5b85c4da411c13ff21d2f5c1c01ce20c3250638e14d041823896e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab398A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E10.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit