be6424c75717ea73b6233777c2f8c4c3c98e48e13607f5ab049c1d8426bf1833

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/www.dazhe.cn.html
Size

1B
MD5

c4ca4238a0b923820dcc509a6f75849b
SHA1

356a192b7913b04c54574d18c28d46e6395428ab
SHA256

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512

4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000780cd935043ce44977f1f575afcbaff00000000020000000000106600000001000020000000d8f7963d1b1f1dc163583ec1659432b55838965417766c1787c0476f0f82426c000000000e8000000002000020000000e5b947f32578af16f5a562d632e91c3a5309735b6ff41411db0739479bd985b620000000c89163be876f04ac6f4640cbd2917bed6124d1f6cc8de6cd16e0829bd029ca50400000001f2573301b063b27f94831341653aa808d683c0263c3de6b641505db693d707c5f1d092486044c369df29fc6edbc5ec46837c047dfa18cc3d071c404d1cb6bfc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000780cd935043ce44977f1f575afcbaff000000000200000000001066000000010000200000003c0333506e4771f0957c2ea83ea7a8cf91ba96190c7922a0cae0b96f10e08239000000000e8000000002000020000000ecab1204e3724a2a181b83c47dbecaeff07edecf2546d94a207345f1dec26208900000006b1dc6a50fd2dc94302021410aacee81dca7b6b52c58e902007e1d8c158d25edd9b825d0565f35c6f178fb3dc53c52b8bdcf68f049cbc6ab81c76f3d1c15defb196e211f432517cc1d7995ab40fcec7ab7337b3373a07a5ec44d758952a1f0e6a51403c2c0f88c92774d9f511a1eedb431607c97b6e4c60f777e955a32874d5186a0d4399388708611994f17cef5f1cb40000000ffb7a8af8e5852a9d3b6233b2e7aeab4d0483dfc0280a779a9ec1f2df3c8b4ff9db27a56b4d16d67edc6a85819488f7d4d448aa558b893ba05ac986d15f6ecb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a5191e8a46db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49A0C5C1-B27D-11EF-8C6C-D686196AC2C0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439505532"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2168	2180	iexplore.exe	30
PID 2180 wrote to memory of 2168	2180	iexplore.exe	30
PID 2180 wrote to memory of 2168	2180	iexplore.exe	30
PID 2180 wrote to memory of 2168	2180	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\www.dazhe.cn.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f105ab1c4db67495da1d681964cc54c3

SHA1
1dbe77c884d6c47d54fefbac17387ed5818b2d61

SHA256
ce278af68ed36df99f765906bfd8ec56f889ba0a1c3ed38ca2bf3a28374f9091

SHA512
7fc6ef73da84bfc930dc3db75af852eeb28755196d500a954ead4066e5704ea9cb6372e6756e7acbf28802a031d0620ecc0d6368021dcb46fc561d8fdedf3e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66763d1708f99034652661dacb89304e

SHA1
39e0eb1d1dcb0d5e8867ed7bd2a5fb310cf6fd67

SHA256
a7c0708371d9e1f16b2d3dba430539b7ae8de62b2115f2a192ddb42bd8314a64

SHA512
355e4d7200f5c680176eb8c5fb4b7a3c0b9dd5d333fd3cb269f7abebdefb5b32a30863e6fd0cb7856690f1bbf0a275d3d4f526dc18538f713be4495820f91d06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21ac1c43a7d17a236fb71841d5ed1586

SHA1
17c09ce3a0ce2f7aaae10f6215cc01ec2a38171b

SHA256
bc5d23bd529cd6ac75f46058e4a040bd253aa35ec2057761005aa1fb7d978ae2

SHA512
7a38c11ff218aaa6f7e5bdce435eb108967e406062c06228e034f9011c85a1f04b5b91b5b02bd525f1a65f5cd511e39dec60f12f14fc8c88ee009b7f85a4e9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d719bbcd3dcfb257a7f5a96da324dac9

SHA1
05e8cf4f98a52ec9fc4035ec0489a5cba29879ea

SHA256
d1fd72b58019bfd8698ecb2040da68168e91cef7add62b2d474658ed6390fa3c

SHA512
974f6eae5beaea1d358f710be65087f2cacbb21359a8ae1afba9878ae5d9a94197fe7cb132efed4aab12fffe8920a92ddbfff12ade1e937574f9d31085e6269a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
621bc7ffc491fb0882c37bc155759beb

SHA1
63e12983bf6a4de2cd6c1acbf5736da64dd23acd

SHA256
9da500947c8fc1fa4831acc5530e78d95bef4c5fb1cf4f123e8142e92cb98be7

SHA512
066ed03fb8f40ecdadf4ec5e7e211eaac0cf47071a0818e6c7729be470c4ed59a388d46846b6a90cf32073c79ed9e66f74be552c64cba5bd7ab25579b199273a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11125e4f1b2a3bda3dc0937b0f5f3a90

SHA1
0db97184ac84729b8bc7a9bd3f5d876629652725

SHA256
afba240e31b3c7bbb2c4a5781a44f6f5595542d904f1b891b6ffe8f1e3977bbb

SHA512
865762b052aa3ccd4422098436f7b065581ebd3d2bb15ad6fa716a5aedab7fe8c2752355b1b8e86112f458687d389c82dac5f33abed3e1587469678845f1de1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1580c998835d633fa3e0ad9544765103

SHA1
9f7494070cc716618fd38e4b3616ff0771bbfca2

SHA256
fc2042de56a98c2cc371830dc6d58035c14d00b439082a5e8d02c07d83af81b7

SHA512
bfbff02534477a7e6214e847f0462b9bd920a39500dc5c4c2d067f4ed00c6749b7de207bc4a1cb1389ba30fe458526819d2a8563b5370ade5d622f39170319cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5f64a395989afe3ef100a087d0193e1

SHA1
d2c119330e5c2014477743c31e98d9209ce8a284

SHA256
9f402ab02d4dec4ad18c9059b04a877c37acb3d8de09cf9142433336d39d8594

SHA512
13e1402360528768e915395f4a632cd88b5a7d9e449b1601c192acff56fde48f306c906695ba4e89ff5b525454ffa4e4727043240dbe0eae24f13d8003d3e8fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
364ec56b9439b0bf781fa931891681a6

SHA1
8524f76f8169c71680d334c64470194664aa8c63

SHA256
8f7eeb714f73fbbd871ba2588c87390b7bcdb1b61b394809f6dafad089ff308f

SHA512
e88fb5a5fbde720bfef4cda716c12944fb32add447d5ece4c02e8636e6f076bff591ddbe8d369617349e39f0b23a2d81014c64cae0b531c4fb8375465adc72ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE17A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1FC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit