e1e69f5eb3d6533bb0444e04c8cf2f2866606c2a1072b2a1231ced158d397c28

Analysis

max time kernel
70s
max time network
132s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/www.china-pub.com.html
Size

3B
MD5

37705de0752d1027f8fc3b3f390c448d
SHA1

b9a36fe59d4092c1e8363b6dbb80c4325170ebb9
SHA256

b8d52dc3f650996a66e32d4fd4f40129f6d5f742a20893615fe1b8dbedac6039
SHA512

affe90e227dd7fed7ac0d9dfcd7a01dda8d7abb454e23a4d98fd7c1c4f8f38bcc7f6062cb52cbca3ac7088ee55900a5b85810e2d258b6896528d8cac87dd4709

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFA8B8D1-5BCD-11EF-9A20-C2007F0630F3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429974419"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000004fbb9be3a874bf38045b1432b7f7d90219118bf2849273c1300f12c80702497d000000000e80000000020000200000008aec0c0fba923faa72169910ecad725037de5e65153c9b0848c6e34adeec936120000000799800e8708c044ca7101a29c1dabb3282c088fbc4250804208e98dba228f9e740000000335f081d913a97f5199e2a48c5256d815f00cd3185ab939234c3201a08ea24108b1ad086dea56d1263bb74571786552e77304e41eecc9953431f297fa6da2aa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000baa87415568e5fe7b6137429a2e6f35c5437547a101b74972e78a276823d04ce000000000e8000000002000020000000e292107aab8def8f7749b93adb69849fcea9f5f7d28e736abef863f3f841727f90000000dfb0e0a98570ed5d72c392bb97ab99b58494a7251dd9aab37e432e0e4f85673223170d586d07fa00f62feed77758b5b463b25661f22f1c5382c3e7c11a840b39ac9ddd59507770d81012c56ef4c1ef6dd7d9a5e0df9b427176320c5a0781a57cd0ab6cd71b0147ee95f8fa00b46082132a0e0163515e190fbdf2efb5b7fa26f86f91ccc0b3f95131e4e67a84cbbe05094000000063dbaf8ec87df46f6d43d02735ede5ac39cacda6e201ae8c4947c1786c7a8dca9340ea2698b82821c03b99b07e65fb2bb1285e6e5bd3bf62d4c16cb51e8b9ade	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d216c4daefda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2640	1984	iexplore.exe	30
PID 1984 wrote to memory of 2640	1984	iexplore.exe	30
PID 1984 wrote to memory of 2640	1984	iexplore.exe	30
PID 1984 wrote to memory of 2640	1984	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\www.china-pub.com.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d628fb59e1c3a917253263f55b3603df

SHA1
caaf9d0659814dbf80e14ba74e0e228cc384bbf5

SHA256
5486fc62ac417f21874a1363e570365e2d355d7b1caf8140814a248f0e6a4c5d

SHA512
4056f5abfe3c15efcdefa0876d94b27d79217fd6f61afc3748cd2383374786726d961a43d003c3b2d1bf0941efcec609cd16dc148df976325e9b85c5d5a50617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64031d7a08791b6ba24e4691b9303773

SHA1
7320cad33e8e6fdcaaf6870daab1c97770129d35

SHA256
38be50c228ca2868e2064486c0ccbd9db32402e54f37f4b9e6ff310ebf2502ff

SHA512
356bbd091ef5ad61547f99a234cb5555aedc6a3d6056c3750bf7f213b9ce56fc2d1eff3be81f2875cc1898f793b08d2446b579b1240092260353e512d5192ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16a5538752c45b7b485c10278cd46b52

SHA1
c844520e41b86d9f110fae210fb2bf15cd108afa

SHA256
6cdbdc67cf525018a842854c0eab3b75fbac0f70ca701558e524ef229935eacb

SHA512
d509ee43762986c9c1c14214be605bf5c536e329fe1f6eab458801d0ecc8f9ddeea2b7f674ba188fb92eb4a2d8681aa7a518f82b541838406bc5ec8ca9d2fd88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e9340ca48a5614168eef4e48502a747

SHA1
41877d0406b9d5ba4c8103b5c7ad2be7eb36dfec

SHA256
523aca5ec9c147f150639cbefdc72001b1ce628aa0d865b7d0afd31b3c1433e7

SHA512
b95ab033d983f65ab4fd95b5b613fddcc6d52b744b1570f61e0f7d578cfce1d00934dda2203ee90632583fed23d2537cada7e0fd5c09f8406bba7a31236c5af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6459bea2f23040ef01906736ce0c0360

SHA1
0518e48d900f75c134748b22c5812e67a72c122b

SHA256
b7a9109ea62ccc57f981cf8932006638c4cd3702ee3e9ad5eaf0eea868dbebda

SHA512
68be3006deae3cff8938d8207b0e716f1c008c414a28a71e8ecfd7f69fef4b0d6d826663f3d7df150ed6e204b9a66d0c93a0562ac31da31a855c7187e6866b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26d5c323a4809d0157bc9e75f96f3ecd

SHA1
f5e4a048a358ad987ea4550bf8b7437b345f0614

SHA256
0e6b880e3fabbbde93e8ef5f0ddbf47cbdaa05aa905b574211bc47af6ee22c45

SHA512
0743fe15c7c2f30765a7884f807149cbfaad22bd024e3b304332330752b171c5ba5950a91a1f976637f563c7065d2bf77348a96642a7a0de0b1c0abc212f8b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de64b63d63cb12ff0c63596e51b709b5

SHA1
277644e17a329c4cd109cfd0f9b96d91f6209c1d

SHA256
20b4db4249a7b25a33e49c2d117f49e7774cc9b29efdb2c047977e0984bfb100

SHA512
263a4d8b4bdbc5de7304875f0aebb415eb1f1399aac566548c9b7383400d37fa1afe3ae9d16f1e3e2f6dd66cbe9418196151e1770a8094f9832f5e1c749655a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b7f20dc3357d1fdd3ad4b1ffb176f9

SHA1
4bf827884e034e7848624d6ed23ecec66f3fddc2

SHA256
1934a8d43d4cc47e7360a91c186c0926f14d8e829e8701c1d3d0e301c8c53f8d

SHA512
c38d0e053a3d20e5013cf53b4f935eff283259daa9bea953932b6cd43fd618c2f058b2114ea3ff11ed3bce76bb6ee2b520026109c615413322a8877e7e51ad3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dff1685706c2764ecaaf0644f9f4f99

SHA1
a4c72e8518e62a12319ddcd07c11c5e6bdb0a1b6

SHA256
1a83eddcdc4e9bcfbe4e37e41fd53e69475014bfe943215035b8ed4b78a6580b

SHA512
12ef16c6cd55c3475822d4361e86524681601d1e920c797723d9debca88aa2a0d717707edc9363a1099fbb2393bfeddb25e343c8fe1782ff4b3f2a86adb7b458

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADEC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE9D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit