b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/images/editor/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AC413B1-A67B-11EE-AB70-EED0D7A1BF98} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000317c3f5c4934d358b477407ab77722c007e07dfa70a17615b5337f595f37ecfb000000000e8000000002000020000000d8bec56d275dfb4760a48bbae83e8fb2f5ef126ae5113e35c69b0e2eec3d815f900000005dfa615d14741267b7dbdf91b2ae1a220498d80f737413696445e889ea452dbc65a1139d429d1b67eec1921ff2cdda368b185449b9039a8d8de7ad42a4175563bbfd26639c0a4f66013c9750bc246a381dd88841d423f4552d902d73f5474ed28c1b9a848d43e3d744a18ab408efccedf94b6b64b0e5d9b4e2176ec1e4f8f1e5e1fd39b7816942ca2d8df801a7bf1651400000003ee7271ca4bd888f6bc2cd731fbdc05bf5a7f348b95dda2b8da56a6d91c0469cbd13ab51ab1698463c4d5c3b440d070c90446c1efdbad2ffdbab55bc852bacdc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410037687"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f40785d74b794c89c2d8e46e43337aeef807e1367b48c6e288bfebb83e9017a4000000000e8000000002000020000000bc68657491c9dfac8010e95d627e8f5d9b801f953acaf1796261d62c0b6d586420000000008d5b105cda6277ab9f57b9c5a783ca8474a79469ee9c3e6d2b50c3ef7b87d640000000c4c65c590827ba59b4dd42395eb3d6ebe659a9a2d2219b14569aa57e769bfff28790aa23a974e2c1c586af8ad97b35ed086f5d8fd6860d9752f33352c0f64f6f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01f26ef873ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1428	iexplore.exe
1428	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2476	1428	iexplore.exe	28
PID 1428 wrote to memory of 2476	1428	iexplore.exe	28
PID 1428 wrote to memory of 2476	1428	iexplore.exe	28
PID 1428 wrote to memory of 2476	1428	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\images\editor\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1428 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
969fc1504e722d46848c7c307c65c53c

SHA1
ce8d3088c4e70a3a367c869150a28a5d5d4e2b1e

SHA256
5e590b3ad214eecead15d9a9588805179aeac623b1f23031f40181d8a42b06f2

SHA512
f662f7168ddb77b8f0bfbdddd6840f4146afd102f7e88e47816a4d6a1140a53a9c03b9e90d9721fac7aaa28dfb5a871d7c777883932f1f03c13b9a7559d7693e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8838caf097e2008200b8354cf6d261bf

SHA1
bf7cc5f78328a65ca621c98fbeca2d5f9d1bd23f

SHA256
fef3f2a21d569f603a1cfa73f0dc4c2b577fe8b44752bb950ade350854cce8ce

SHA512
181a8e8becdf3ab59a247f8debbfadb79ce20b4bd7bf827f5e99e69eda00c2cfb77daa98a5e2c5564f2a0eead268407ce358b3f3e074ff5ba20ee3f6432db3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05b97563376b89d7adfc698f7602ba78

SHA1
aacaad84f51216cc8d11c9cf85fa83bbb8a35cb4

SHA256
ee6db565102eeb288d86500b404a1bc6b023aef220f358a12f6b42ac5ecf9ed1

SHA512
28a0b781f71e456479f62740a0490828625e1409a1a0a8538e909582810d6d114e2a07902233dbe60fdc44e5fa0a50732c84dc527042efbe0f65e4af8e5f2a56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6fde2950f9ec05f4da75d5148b5fa70

SHA1
f9ecf85d2b37f7e8be7a990b7d4aede53b0f2de0

SHA256
c8d362af464a341c6cf1741d0bea295c880284021a474d8f30943633fcb86e13

SHA512
09af122bfcdc96989200d2ca3a32a831066884563f2ae072ab0e155f0e2144fefc9573693d1fc6a718a00aaeed148ec7d988185a9f629aae0abe9c5055d16c03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bed67daa85ad3f1e87db712fd9739b41

SHA1
9272ef8c715b1b17349f6af6114ae2246ffe3874

SHA256
85f4f8b68dfe3f4cab82809e20827e4a9281fdfc548014f391e55db2ffe97f7a

SHA512
a5bec5242d04c55ca63417753682fcbc15c1045f88edde85a985fd837ada4ea2507b0094f7c9e487629111b6b3149d87c91e85356bf473bbd183bdc312a822de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0350c6763f9b3645d85ef01195e21a2

SHA1
f0d5f741e7bf927cc91f3287d373f25d76ebb5cb

SHA256
6c94fa5a29e789b08f21459b68a6986b7a9899a439e52e89479d90379c0a033d

SHA512
303bfa86b80f168af173f9e2bfae25c18ea74a6213f8daa3a4c0878cc5436aafaa74bc7f6b7a9b09b931121e5b5c2e2f3e827888342583fc0cece2b32806684d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b47c2ea442afea9cf406c6758deb8ed

SHA1
e46d6d8afe425a0dbbe34ea66378af10cd47d58a

SHA256
d3dc6bd627351cb88a45bab4a6d25639fdb14d5693105423c6ab1f0f151c85c0

SHA512
92aa61cf857e078dcc334fab2a56b4ef044f6f380f66f3dbd8bc05ef42e23a3f4281dd135bbbde93b1b75e9c637d5bffadc96052245e46c3d09e5358e88f5140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2185de0f3399db197aa354a10f5a136

SHA1
7839eef43148e9f46bad02937b5f0b8c6860fc00

SHA256
f603bd15efb52bac6265997b924069c9daab0c03b77f1e634585785ef68126ff

SHA512
f32a1a114c1a042488baeeb418429ce15fc21118c10d3d13702b1bd70143d4f5019785f8953b82c6e08c0cd37f81d12f78b09a75cd5999c362731fb8a3c56b4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1025ae46c078e34bac98066bf808b2c6

SHA1
dc71ac5567845273c8e2345ee7b48b151cda6302

SHA256
b8361a8a354b37ddac7f23c6861f879d6fd9225fd9d60c1e01731ed959e7eddc

SHA512
7f3743065f5853b017c894f8408113058266a4f82de364ea9e19d95643ec404b13f8a415c20e15d656fbe749c867417a4a0786592d6bb6baae076c560af09836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95fa3e780427ffd5dbfbbceb41af34e0

SHA1
7bebc44bfa4f0735c3818306ba41a3a8d8e16d67

SHA256
573fa614207376146fd0da7595bc44537b71d22ddbc7cfd98b8f31f97051ec2f

SHA512
2602dd20f294fcbd3f9cf1fbf45497aaf507e817e03ab07000866bbd2697f1e796b66f2c7a3b1d55ac294adcd12307fb6824b02a5b80505c68f2caf62fdf9b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75675e90bd152409c6ec1bf870560fd0

SHA1
4c18a7ed454b771a82c368ba95da63e831271726

SHA256
9e97c941d78d424098d069278751075a55f212d0bf91ec03a6759577fc899108

SHA512
61013be594b48c3890063b8d6d89c3e9cf2b92e5012676355beb291c8f981e31f67bcba598a5a07af6ab3e4e76b2e89ad0f86fd4ee839929448c4f72cc37351f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2668.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26C8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit