b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/configs/templates/ak/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1249E161-A67B-11EE-B3A3-EEC5CD00071E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d345e7873ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b5afc618844cfd8670137315f535226608f4b3b96259e2b0bbd57ffbe5b3b2b9000000000e80000000020000200000008668c500e0a41226841e16040872d9fa6f0d2d88e682499fa1df28f433e6e39b900000001d0b5984b98ebfb13167faa11139a9294d897dfeaeeb1cbb2061f09b370090b1c4f51a245a2426cbc85cf54a7a5cda0068a679e237056e7f9a7153043efeec862eb4d7c0f05c8f991707008ecbfc4cda5aaed4c6270cf75d6cae37ab3be47a5237d55a989d2e4175176f0acb7bf3d599d40b8c810b46651c14d129f951786d9a5075cebd383e320326268d22d911957c40000000c7d75e118db2944cbba597215bf5f55aa2633a261b00f25246f4fd81ec8aec373466655afd297fe6ef83b6ad519b6dcc5448648caaf7bd5f7d941b50c676b5a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410037676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008d7d33df7e3b4933aa4985f491dc3751ffb3182c29f9b332e75d3091aebf0f95000000000e800000000200002000000016e969c97c5ac04ba863b92fa0cab3e7748805ce445f524206f04ae5280a0f3620000000e313798bbce6ceab4d6ed2e4e5d43fc3f68b8697509670cdb25b949ff507895240000000b14cc3c427a1cf44d9f31ad0ab8337c08ba7c483a827a54eaf30ecbd23b4e3a8c5548931d9a071809c199be00b85f0c42a51bb3cda4ce3d1c1c0fc255697774a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2752 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2752 iexplore.exe
2752 iexplore.exe
2784 IEXPLORE.EXE
2784 IEXPLORE.EXE
2784 IEXPLORE.EXE
2784 IEXPLORE.EXE

pid	process
2752	iexplore.exe

pid	process
2752	iexplore.exe
2752	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2752 wrote to memory of 2784	2752	iexplore.exe	IEXPLORE.EXE
PID 2752 wrote to memory of 2784	2752	iexplore.exe	IEXPLORE.EXE
PID 2752 wrote to memory of 2784	2752	iexplore.exe	IEXPLORE.EXE
PID 2752 wrote to memory of 2784	2752	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\configs\templates\ak\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab4e07ddc235f2067b94513ab1289c9

SHA1
f34ed01af67bb9f87edf9b91131956743ec26711

SHA256
59ba7a15b696743b83dcc099f014d83f3572ef8e3dd8240db5c03deeb44e312b

SHA512
f170e5dbd351be3f1407f374baaa5890bb24fd545fe159a70749248fa7072ccee055b168b90031014b3ad511f806c887fcdcc76e737be896ea938d7a17fa6bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec9c510723280e2e1557c612d6130006

SHA1
09357af7cef98abe7403375f5ec5c9652f2c85d7

SHA256
90bf002434864560904e3323c25fb4bbb75e4d23b3649ffa85093a28432d65db

SHA512
51968c12b6beb80c51c15fc80ba2de72fda65d4b8c1a6bb0c6bec0c33024d1e9774c27adfe727e81398a4f892270704e54297f89e3b465863eb835223360b37b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f9dd8834586a1d7fd350b2ccb460d0e

SHA1
08ae7c190695285615df155a8c6c6b09fa7d4ea1

SHA256
89f7e27f10dea061286be970ca7815e098eb2b46523f61137d72efdb90b642d5

SHA512
45d5f80d768fee437c58acec3b0c3d2171f472ea2cb8d8911dbb3d2ae843e6ec3799ad80d00b61fde0179ece95b5d4b751e9e1272338dff811522b7c45ef1233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d81bc2b88d498fb7b7c243f0f684291

SHA1
9f90036b2200842f99a4b2de0466cd5318df6d9b

SHA256
a56a27a048bfc298a1019ef1ec954502f78356e818c5c291c2bddf6b6fa471e0

SHA512
bffd7a47225947a76791b3890bc946528ac4a987b4616f7bccd178713b7317dbbab91504061dc02b0f94c1e4517af637298b326576ed6e8af04670aee235d5c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
155be49dc8da6259859e9045b27089b1

SHA1
ac92c54394ec0e523ee79643b97cf0bb419cc738

SHA256
c9527229a17daf40da6fcd5846e2105394cd2c469eeb258bade49b655c337920

SHA512
29c33b6fdd048efec098a4ed8909096a5738eb98f8cc884928929094e55cfaacbf74e20a5d1e1a7b62e205f8c497806883589033adf705ac71105dcf96c38782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f42e2440b9f2dfddbf214225dba35700

SHA1
486b98d5a362315b0d6e7e11fdf1cb51c7672cad

SHA256
e4ce87efc46100eb52fb79e58e648a03039a98b3a3263a82f5417d655eb8ba6e

SHA512
d932438d4b9652c20187cb434e0c13e2cf0efaee8a26f0c9b0986403c4136bd8bb70a92da66b3fc8c733b44d7eee66440aa5d5a18f2a4c76cc4d94ec017746a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2cda640597405f3a62f7f7dac7656bc

SHA1
f6c29f6f78c8d32fec89b2b9230628f4f0273d0a

SHA256
472dc39917dba95d5ee66761558a964781c655d6fcde04c9580583d0b1180a83

SHA512
87ebdc72e91dd86acadea837cc1903f22448e106c3541292e57bb0c0d3885beb4bf3a93f1669b6e7ac62dedf591a7cbab7ae06583bb6f06d561ceda245a38281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccc3a4d59ce464cad59c0d135784b50f

SHA1
01204888792ecc5dedbb722d2f1c02173c0002e6

SHA256
8cbe7445b783447275cc5c1cfcfca5ef85635380baaa2dbb85d7b9d98ddca944

SHA512
799a871af812aa2d984b8c265864aeeb477ad4401b9522506c32d31d847bf924ea0d987ef4f59554c36e5c8cec50818b292b253413f0119d14dc71c980bcfdbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
858cbcf459d1639a309ac1befd5023fd

SHA1
7765fb0f4ace98e036b8a4eb632acb913815e4e1

SHA256
e0890af3282fe2baca2980619e1c4eeb07c5dc9ab2569b0517b8f145de5d801b

SHA512
7365735e6bca0402d828e899a723a1a8ed141a7a4f45160f7548e7c463bd44bcb912170864b7bccc6aab52eb5df22ee643ff11556875f919916252cca1f5a40e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5c588486532247f985552b592ecc5aa

SHA1
2ab8e2063a04aba28b18b4f8de2a1363919b15bf

SHA256
b7b1fe6d8172ce7e452f76d77f975fed23ef562ce74b3c6e3e340904795c3870

SHA512
f63486f960dd6e9a923c6619bc9cc799b316d5109db0b33489c450841a6132af7b1abe6496bbc0f54e440154dec6794b9b911c670d8d53462e03cf91db3a5ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19669347fed45651372819d32d3043b6

SHA1
9de099a9efb3e4231ac770b4b7a3a1f9676bfe16

SHA256
6708c5305912b600f9c912469c523901616de272418dc5cb19ce4c3dcd09f480

SHA512
3e85d8be8012a771308a71b843ad127fc9b7cd0208d5ad1b6640161d006cc9832c0fc9a7fd3bbbc89eb26225a7362e9eb64adf7e5db1dd7d5005423aa13a2b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab873C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar880A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit