b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/cache/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{097634D1-A67B-11EE-8FC2-4A7F2EE8F0A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02fc6dd873ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a8a9dcc46b166067182310616945e2035605486cf98070235eb7d51300b988fe000000000e8000000002000020000000f9108061e889c58e720db5eccebf96e587d0ef919b0a08e3914ab8f9798b2fd220000000015b042da5ffe72b3358f4a47e1551236f3becca61bfd1986c67fc35dfccaf2440000000f95b3d1b6cc26484609c4e93fd0a145b778a41f5c09bebb0b8e9e41087c26b7a2f5659869efa001f1208a734858755ece6456ee55a65d57a9027090b3327ad35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ef82be274d651ce76dafc8cdf8a9d164451d867ac61e5e6bb175443853bb2bf1000000000e8000000002000020000000532af64b0b82a8788f1e5045cf97057e6ed9ff77d91bf41fa7fc12aa034f0b8690000000bc8bfa7ab206c07d839e4fbb141b6943e036298e4e1034011086f7bedc7f387890a1900ec0de5fa77ea76b88155e29bde115da5a6592c426fd95f27dd77d8bec4a73d16c5d12edbe3fcd8a589d12c7f8c584a8497670fe6989d5569afc6fb571b6042878807c707a651b96460e976dcbf3361e02a77ae1a5a9398495397935483544467d63cd0d428c5e0d4763b0e135400000007dfcd4d4605e9c998e36d144317e9b3bfaf945d9016c933896a321f613241e2710e35a4ba66995dbcd503598a99c7b8c182c5e7ee17d5181de680a8bf961bc1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410037655"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3024	2508	iexplore.exe	15
PID 2508 wrote to memory of 3024	2508	iexplore.exe	15
PID 2508 wrote to memory of 3024	2508	iexplore.exe	15
PID 2508 wrote to memory of 3024	2508	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\cache\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee222b6d6d4ad96fcd23983c5e6c460a

SHA1
0a10a23d47ea5cbc8d9d59dcbddfeaf2216c1d75

SHA256
c69486fd6a7d04c0b30599d11e24ae6e08b5e5da8cfd48314d22ad9d31837621

SHA512
9c67e8b6873b074c29231f367f718e3cc1386cb560c06dedcdff7ecedc441e18f94d456544f8e4c17ad3c1f9f9aebec3b9554abbf2758124a5b857ec8ab94b8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a54c264e42c9fea84f171417a782744

SHA1
bfc6b8bbe9fc9df40c6139b191ee0ed4a3a3c087

SHA256
e74e13805b4c896f369b43566436b6b229b44f58643aa47f48f0e33974ba9157

SHA512
6c4a6888193c3db019d2790b3898909b83183a917df79b8757a4628fbce41594ccc7057cc996505fe700d0077766a2e86e68d607141de0a15c636a56de2331a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b5d50a7c06e217fb6f1e71dfaedd63d

SHA1
b349df9c1f7018ea4a9e549afbb825cc1b89d92a

SHA256
2736ed6710d8e79f270d9bcd6c123f6c96e98584e52aa627b9c041aa262952d1

SHA512
5de3204ba3e9cab68b58f18bda3881b7b846ab42c87143cad7df62a2b3ac1b3c14daa085ca5a950d1005128496296a375fd517b1da2d009b701a0ace7e928038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75f1c8c0864ff9446e6f2341a82cb2c8

SHA1
d5c09a5b2339ebf6e03246eecacab8bea7328c1c

SHA256
7bf8f268a50e3b0abc2cd5ea03193c8d1c42d015e9e68c0505d3c52fc35cc8db

SHA512
3880a4344463ec6415d6fc15ccd0b620d86db857d707b3a3087d0089beb69225afc04b112869ca54c03586697642f56198704e05c9220843d7a036c8f2585912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24c4bab97ca2674acb20905c749c852b

SHA1
4828dc76111e131efb2541099c33801900b3becd

SHA256
bbe9c7d64200303176a3bdb3b91bc3cc01bf06ce637e0f57b57ca938b1662172

SHA512
a961cec7e7353f57d7aefa0cd25fcd46a9929202fe8973395ca271c162fd37b95ff872d89a0b59d529f4f01e5027e9ba95064010862db07f31ebb0ccd17f8bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d38aa5b5a6f2f5354f4151639aec2d41

SHA1
dd82c17a814d50a070f06d34315bd5b38e84d14c

SHA256
8df4e08c5b4b34c41ca5f5c653416d201fa9115ce844e6186e6e3487a85f99b6

SHA512
2c58f255239054364e88cc2089950957b6f824d5822ee8f6b3774e6c1c37d698ee846cdf04bf57c88535a8394d5bbdc55e1fc56bdc9cb1761ec7d9e8cdcc92a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f624f66365657f887ee82227fca081e2

SHA1
8386aac7aa3c38172ba9b302febe991f3ab62d6f

SHA256
6543a0154b15bf41671adf3a5002a53b269a733744ecf843e699599ccc834721

SHA512
b162c5f8483a7c2a9a401ec365b24841193f21d9da240d84be2b398386ad2224f3154db101b40e92c60fee481774a4131c2237926b174a15661cc2f89a311d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14a8879de0e4c3e4ce371fb069fb737b

SHA1
c1eb4fab36513e174ce1182056417eabb8568af2

SHA256
e30b418675d8aa3629fd2c0bc580a29d083278c065789dde11d7463955d23e00

SHA512
fc0c472a2f2cf5a3e9130979e7de3cd3dcac459a363db79490fcf7d5a621bb577e3f012ea5ea31c838b07c2bac1bf21e3dee0ae56fddb6ecc8ef42bb1d6b7448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a6fc12e2f77a87c319b3862f0a1e16

SHA1
93edb323430f8f9e61062158657b56e1e0c8051c

SHA256
53b73ef49028a6833100adb0a96d1f2e499b7d8a4e8161da1e3036759a6be4ec

SHA512
c44d972eb19b00e8846e92a8e88854259df672b507459b37acf545bf05dd29db3eaa9c37cafa141d51ce1e1cec5e11949467b079270235fa7be28695bfab2386

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab341E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3440.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit