e1e69f5eb3d6533bb0444e04c8cf2f2866606c2a1072b2a1231ced158d397c28

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/www.dangdang.com.html
Size

1B
MD5

c4ca4238a0b923820dcc509a6f75849b
SHA1

356a192b7913b04c54574d18c28d46e6395428ab
SHA256

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512

4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429974417"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000025086b3a0b00f9e434b34a8e9c444bd7ee6ce5e2a24269722ef70491cba6cef5000000000e8000000002000020000000f48c3000c6bc0c04e8110a34824b14edb8ffe235f6ea335d2197b7dae8931acb200000003e91f796d240268b885a4055c8bcd86996ce3c1b344c11ee9e97077c672b3a8d400000008dde786efdc349d4a19075b14f5602ddb2edfa1e832eb5af452da19086c7856c99057b5a36a735e19855b0ee37f78feeef2e073f6863fbc9f13034f17e07a707	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEF6CDF1-5BCD-11EF-9F09-428107983482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0927ac3daefda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000006bf5dfee90874cca22deecc530cf35b63b279c508cc9aaaa0c1557cafaaebf13000000000e800000000200002000000012b91c6f27ce547816c214f316692ce8ab0b55d6d84526bb0f645d384aeffafe9000000064ddbf78fd6d8cf3760f61ee86df1693a8b75781170a28c5da0ccdabd5c85f696fb78dfc200ba0c102e3b6434bbca04045c55f43de96d1c66471de56b34a106f1e87a5ec34ef6c9e71b01a5b1d5ef127e85318689ed2668185f00bc88d6a9796323cf2734a3b234693505c0c9b0913e8b02ae7845ad4062a1b0f86ade1585700be42f137954ef2e38741f41cfeb61b4b40000000b38cd2d694009c1a2333c761799e7145a705f0db307d2864a914fc4cdd6d1aab61f07f054658216dc694a673dd67da1ee4fcc4ecfc3d42de7b8bdd7bbd026d7c	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2820	2232	iexplore.exe	30
PID 2232 wrote to memory of 2820	2232	iexplore.exe	30
PID 2232 wrote to memory of 2820	2232	iexplore.exe	30
PID 2232 wrote to memory of 2820	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\www.dangdang.com.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee9d010fca3ee47ff5bc8e67dd0469cd

SHA1
26b3786e44e90ee9435b332f27078cc69ac907e2

SHA256
e0f087070bdfb7309fec1f720b93a74d66708805ab2987fdd2a0c74c3e05d7b4

SHA512
ab037ade7670c0e6033f9e049d44706464dc9a9b9160ac6fa0a8e6148e2212718658aa3f4ff778ac9a20befb7bf3413e8d32c6a78f37775c5b0951e9c8c6c7d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
563111ab49a47684ca80f59da9a65f4e

SHA1
57fbe9389963b4bd142fba79a2676f0d1f46b47c

SHA256
43734bf12b8690fc34f5688222200909dc43edc329755d70140ac2b9bbe63d0b

SHA512
619aa50dad826885b13cec2ce9a863265041c4800492dc897fb9015400ac0b041a0a5ca61f28d221c6af3b02e84d6c81bcfed9a56fee24584c28cf6f55f29dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
929650202fa35b6083c0f085430d8de6

SHA1
e2dd4f091daaeaeadd044dcb7435636c4dfd49ea

SHA256
f52f016f33f36f9b3663ffc5f9d28a6e058d4c5e9e4956cf06f08b8a22e0d3fe

SHA512
4e4d4c6d5617bbe0f9228299a9c4a42de3dbacb26e3c1661489847675ffbe8e33dbd3e15086950c09c1256b904a52974aa35160b714479cdcefeacd2c9eb9b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815132ae7f061143e90c375808da419b

SHA1
72da5dd60b2e4fcc70123d549d4fef8c07aebb3f

SHA256
107d13d84e59cb49075cddb0d368b81a5ed440ed26b3cbdc5d3a1e9d08a7a6f6

SHA512
47c864af3412f9c411c803b75f1418e6f8bcce8ec42422f394db3c8a7db658ade685028be79e297267e4b2f26b3b487f2ffbabc489e862ca7dfc46c40ce45517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
332e85d8e885b00cba10d5819fd5de8c

SHA1
c2aa05cc15878974738f74c2e0c5d346d96ab0ed

SHA256
f57fc834abfbda414e6c3da3f4d26c41cdf87fa63b4f9b8ed915df559ab035d9

SHA512
885c146fab2ce162594382e1f7c0718bd025f00c48c8e1ed80b2284ffccec15ca04309d73f41a944474d955e3c78de17cd452cf5b42d4fc6bcfcb04cae6b2331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfca7ef395507673208e241f1911cb03

SHA1
bd19fdacef9540763155e649d5e39bd92989be99

SHA256
4dbeab7158c05a5102cf285c58bb2a6ff852dace23a039e6a3759386bbb7bf26

SHA512
dec7624fa71f2f5640f0ef2fc089fddad3df8eb3e0a3cc3caac25200aefb0b1cacdcf1a10eccb55c6a532201dbeb8d0d3e23980a325d1506b22a6cbe39ad60d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f693d026818f203da0a9cab1e0387956

SHA1
8e8c4c8ac8972d402de4a02fd90e2794206cb63a

SHA256
29964e501530c4e918c7a0718b057bca8acb042103103691ce44afab2665686c

SHA512
f1d6c31adb828426844f80d64644b0c9ac04e5392c79a6680dd45db218f053ac88500c7501b3907cd8612825023959f6203be24c42f3e9ddc3a86fa443ab8c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8db66bb7f1989bb211474727742bd944

SHA1
f7a25c116fe1467da3af3f32a68ad60f96d7300a

SHA256
a158c2d7be7c7dd9365cd651970a9aa76aa7845a63b3e264d0d19518f335c3de

SHA512
b694226bbd6f413a5ffe01ebd4fcbc1d6556b549ab38cd293a4d10144d14577000a7fe52fa076584b2cb93c4e4c6b9a758a3ee25b848e7ff7aa9578a7904c226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68c039483ded4f66699e527c63f4d363

SHA1
4cffa73d5736ef73b98872a5f507a730e4dfaaf4

SHA256
0631d643afd6a0b00358117b4436beb6a5bdade097af79b5ed5a81321f5291af

SHA512
2d6ccf2d3675b6831e792b329934f1b5bf52f173bce6c137078f2f262260ba1e9b5daa03ecf97655666249570c18c18910feeac3949db244bb7e093a76bee0ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15308ff9731329abce5d3df08ac41c00

SHA1
2aede93d758155e3a71295afccb96c69facb0ed1

SHA256
71c2dd63d9761ecfdd0c764615a05197f6bb73b87981201af2cd05cf19d0ad39

SHA512
13ae26a419dd941b81957843c8027c5123ed9f38c9bae63c8fcfcb7618fba83d3f25690c26ce5f036b7a6c0bd68198582f889fdddf9534a045ba01140f5c6b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bd9ca1e2af9db06bdd71018d660069d

SHA1
133841b4b6bc715a08c691b71c80e74b2f2643cc

SHA256
a23f7f18374c4c428d53e30ac198eebcd73b9c84bd913b061b1251332ac85dc1

SHA512
e38ce1dd97e3efb2f4428b4ffbdd040d4d4fce49953e7057f35523ac55fc5f5250d9ccfe04d3e0f47d066ad398f32dc4c71c3c0bd45099a55586e350d4c4f22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
709d5b5cc7dc7bb1ba43a2d8e1513c71

SHA1
81d117f78027a86e0b84385ed705723a1c23aeeb

SHA256
ee9043814c85ea81c4bcc97532595d44a1574d1fa710396abd9aa739bd428ccf

SHA512
7933f5bd0f3c5c7c8a192a29972a6280c2960cbc769761d5e25944dd89f0b60f6c2cb5c1efb02b31b7be444957b0894b0d09de5a3ed84ed5aba76a4e7701faa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D42.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar414A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit