b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/images/admin/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000246708e0a668f48b13c9a827b63296a85991267e410963d11612b5a8a50802da000000000e8000000002000020000000259b5fbde3bcb5cdb33afc91b73f244b2c88eb7f506e72057c6049c4bdf60086200000006823c12a2c6a54b267d312159e14a0a592215ff9b6e26fa15755b72aec7527f940000000f847c5aafef8c9d442eba36a82aa1d81ec5f4ce32b380bc47cfa68cf17df8fe7958f8f1ad63988bf54b36cef1bdfd88a8e1d189af6b1f7ccb3593a1db36e524c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ea38ec873ada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17C34F01-A67B-11EE-832E-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002f60994737f1292ff162dbf6b8b2da6f21321ff5736916d6c8e8af71b3034f7b000000000e8000000002000020000000a72b84a3b37dce049403b66dd2c030b1e16590793cfd7c573397212d0b6a775990000000c44c87090fe68f4c5aced2d47a4dca41db74621a0718479df0f8ac14fd28d17333f0cf6dbc2839f5f22558df346a23022a2775860e0e7bd51d5d0c4728bbb1fd859e897527adb2105a3ab935c576ef39bdbc84a51721f4451437b8e519943a31c56c3cb0450a9aceee7d4c8ac97847f48b85112bc1ae688c61a3fb9f7531c45884f406e8e388cfe6b08e446431fed52f4000000074e347e5e566e4009ef824ddd2e86add2881656beaa73fd0248da5c32cd074b4268a7acd1a41006152e0390746ebe2046a31c46db7e479ecd67b2c4706ac572e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410037678"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2920	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2920	iexplore.exe
2920	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2672	2920	iexplore.exe	28
PID 2920 wrote to memory of 2672	2920	iexplore.exe	28
PID 2920 wrote to memory of 2672	2920	iexplore.exe	28
PID 2920 wrote to memory of 2672	2920	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\images\admin\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3944aa009f0acd36433e77bdc94586c4

SHA1
83d4bd0c50e582cca368226881271c51a35b66ae

SHA256
5e5efa23e165c8bfa09d519f762a9c52b724b18142b328ea24175c2347cf403a

SHA512
6a2cfcd2111efb2a31d2dfc90e3e8c637545d0dbb5e16fcdb91e344e7bfd078dec2506ddea91eeeb73eb4b101df0353d306802667872cbd3338acb7cfbf934bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b91013a7f72e4f502c6f3800ed16c913

SHA1
41ae5413b5169a56479ba12a575ad5af406b465b

SHA256
3bf182af839585149752e094057a9c81d92c1de9a5aa8ea4095f575680f55b0a

SHA512
b2c32cfef41cb31bf0be00ec52b514c45f5ecc1afd881eb9064f1e50c31c69654464ac0773a3c15afe1e9a35c48750ba54896a592f255ee20457f3956ec530af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83ff8c84d4429b41fc25a14f7633c503

SHA1
337da3d2bce60ce44d3af9a5654b84c5cda4460f

SHA256
11516d03b6f4a420fa5f0e194d3bbe4694addab9865b924b6913f9fdd4c44d8b

SHA512
45a422e45c3b9e46cbb12ddb85c473fb1072e5314913a277c69f5926380fcbdb5d473e645d1f037df1394ac49d66e762b63cdb4da985d89d8de55c8184bd86cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5aa6643535886a453bb550b4e07a2188

SHA1
44487ca6a59818781b9e0657c1df19c4b6ae15a0

SHA256
d3d4cd058306659bfb4c578056db709a770e547814996eab58771e74a732aad8

SHA512
26fa298128269374a41470a766e937ccc7b3ce601f14aebda90ab9a9532d49a7abb959ec546bed2aca33399d338c806b7d6f6585ca178009093065e79fb8b804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10c42bd6b2babb9e883e53defcfe765f

SHA1
90fb3eeb37829fe3da045f3571c4618b0422c9c7

SHA256
5f74cd07805c9d59786fb3023b44847aff60a2fadfb64fe54569295b64c6fe43

SHA512
ad57a9fc2457714115ea327cd4aeec8895bea38e8d960049e46f54b0f42d99517ec41f6095661d0a54bfe7f4394e08998356666be6aeb0017bc8216c1cefd377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e264be858238f31362428eb544a584de

SHA1
600f44c59fac0f168c46a509435d418c3bf8763b

SHA256
bee7337eb3c0a7abca012f82054be71dd0df6bb18cccc64d6dc31a84e5d9c31d

SHA512
9b439daf5aaa01bf0ee689701bc1ac280407b8fbb81c03c741a430952edfdbca706f4b95cf3b4a0608b1ad2f7bc4ad16bcae0240ede52741f2867b0a2610486d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5866b0fb8fbab2632cb29ef2105a29

SHA1
cb0a6da454219ba13f78471d17c07a5668199c11

SHA256
864be1f26e1c4649240ee45dd818361234088735d2f6386786389865126874e4

SHA512
c48a77a87a0dbae8917ca124b13c9179f8f82fafc475b5cc7ea7b183f80ed6521326873580ddd909c8f9bb0fa97246ddb0074e1052a5de525d8ad755b949d231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31fcb3cb75963ba17794cf1cee93c9e8

SHA1
90bbba244f8b6adf7c4e978c06fcf615c229dc83

SHA256
5dc6911b012528fc3e01869e9aca5e6f763780981d3db5465ec32e23d2e340f2

SHA512
6f63f20146fbeb233e7e5e9d383f59414865ac1bedb8656b61f1510a2b7d3ca3cda0df468169f9a6b55818aa2163803eebbc89fedeb1e98f1e15fecfc5c3199f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eec59be07727a814ce175a2bfcf46dd1

SHA1
a005acbd802db85c63e6791204de2edda9c5dd6a

SHA256
b23cfe2a5db65777f5e27ae5fedb10117e5d7a6d7f2ae9dcde47c26cfebe8bf2

SHA512
6a5a4a3617bf0989c7d6b3f8b3c16e5e92784f912997d4a07292ba6596830262a8595e63c17476f5cf3ef697b038b9bdd8b9ca8ce49d8c9ce0ce40879652a74c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05b447ddd346f27833dfe453fcfb18eb

SHA1
981134c6f1a9508b3b21cd35d1fe3db99b5f053b

SHA256
90ef00a253c17d8aa915ce9be1b6b62ea3f977a930c7e70e447a537916b15dbd

SHA512
5829cf945d138d9816ee9047d8f5c1d73ea90b5aeff6ca903398e61c79123b7a9af1aaa0744aff946fa428abee4efa988a33254b1ecec0a52728eaaf5287ace1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc1274f3b24724dab396ed9894df0e7b

SHA1
fb13cf687bc076c17e77f62af54d3ab7380c7609

SHA256
e5d111413c43d919eae2c7dbc552e6d93ac5aa4d9370e34c2e1e1e63f7254b4e

SHA512
ef635859edb89a2c7c8ef37dc6fda4168e56aa83be1e766703559e81156233c2b7a6e6cf76d5e1bf86af1b5592a9a4ad256d01f5bff985f1bb0572bdb6a774a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f715e743742a5f2bb004bdfcbc6d2e1

SHA1
6fee9d41e06d5dd26442a734a07773770c7c2cd4

SHA256
ec2d266f73bb1bc9e9b39036609e32fbacf7b4674c4275d3df44d66debaa56af

SHA512
660685e99cc9640cb43487cc33df6cd01d80e6f014443ce9dbc9a5c54621ff2f4728be9cbfb501d1b748e380abfd06e7b6075f6d6c3b7056429a5bf6373d4d40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b76600bf88195069e4ac04e8f758dedb

SHA1
b8f3da78c4997d1c82b04d24b634fb309db54c31

SHA256
9ec02c8eec2996226776fc9c5c465544232bcd03f2bf0dc0404ae02dde9b0e13

SHA512
1d17b0e96d3bb77426f2b171962989a17ed3268ef183b6205e5bc5cb71d963be18421dceb8f3cab4320c39f239e4438de54859b1a876dbcc165ab1f7d7327763

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3131.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38F1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit