b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
119s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/cache/tasks/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410037682"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18EF2CA1-A67B-11EE-8CF2-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07e3eee873ada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c39302a42816ae409270ad571a5ddbac32121d49e46dfb308b0db405eb4c9f96000000000e800000000200002000000049f8d9fb23edc6490598961bd8f57f92c474f5f6c009a447c25c93eb42c50d9690000000c68788a62d59a3b2c96debf96abe961cdec7047bb027996ce7d7d9d9fa1589ec802a7fc4095193793c2de1cfc918ca600bb9b9a9139e1ebd2ad80c67e35af43bf157f3c72ccb2a7380c2dfe9dc2354911bcf2887969bf9a32d163d27c3f709958065feba9aa8b5ddce632ad324bb7cf7ebfb1604350f00ed18c576bc8a85e50eac4504a518bdbdfad8b9d1812bc47ac0400000008fffc5c30c144b7f939e0218c2771792691401ff339e3c6761917b53066f02ea93a538bd1cdf6e1164d639eb62e639568dde7c771aca953b202b53634aa451a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000009ffafed0fd08bd0d0c2a72587c0d1677793e700ebcdcc491fdff47428162d815000000000e8000000002000020000000298e861b6d35643cecc5ff73dd097e8e4ba1536dd81667d5a43f98307b40c99d20000000a73c3ca5055aba41579d51027f12cb7430defb942c1462a67521b2b7f3c0892f40000000df5f87b4f083d63fb2ed19ff68650dbbe02bcce8e8c4538f9c78e477d94e2fca41d1611a4b9e3f3ce32e4b2b757f9151f508ce5cde5c53687b5b7f63ba4637a8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1512 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1512 iexplore.exe
1512 iexplore.exe
2724 IEXPLORE.EXE
2724 IEXPLORE.EXE
2724 IEXPLORE.EXE
2724 IEXPLORE.EXE

pid	process
1512	iexplore.exe

pid	process
1512	iexplore.exe
1512	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1512 wrote to memory of 2724	1512	iexplore.exe	IEXPLORE.EXE
PID 1512 wrote to memory of 2724	1512	iexplore.exe	IEXPLORE.EXE
PID 1512 wrote to memory of 2724	1512	iexplore.exe	IEXPLORE.EXE
PID 1512 wrote to memory of 2724	1512	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\cache\tasks\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec12aca222e7bd5e73e695e95740067

SHA1
37bab626ccb9681c313895a515299b558bc05293

SHA256
81e658d3fdc636df88e5f2d85f2b3a7d62ddeec250ac26c0667b8b4934f84446

SHA512
f5871d3d5536053c49b8c201295339c453bdb1333acd1998ef99ed485e21d0e149c250e00c6688929c9ac362dc49dc7ebae0bdc38c0cd3c68c09d9554233726e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73f8aecf47efe7067b4c61740eaf9659

SHA1
1509379d32b8a2bf382e78ad3f22fb0e60114a0f

SHA256
9867846ca265a6f00955f428ab4bc8afae2f2a12c0d6e30035daaff9030ed8ba

SHA512
d9f3b3fb2f4c0bad62e7742812a995c15d4b6fe554f69e744a9e81ccb41e490aad435ea9e63f345071d135ca21028808ad1fd49031527f7216a99a7c4172bd72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea780e8925c0ad0f489733f6f6ee9369

SHA1
eb6e5d46b4b90a0886861c7d4df6c8edaafd2452

SHA256
4369dbe8609450cac60adb95cf6a773bf2ed0b9fbfef826592f453e11605503f

SHA512
4172c7a3e8786afed78e95de3294433857ca9a0cdf0b5e532d7af2cb51b15f811bd860a72cb66e8f74583b7d854624731a7878ac04c1deee503c222c3c757280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0908de873b9d0bf6695fd6262149421b

SHA1
cdca4cf47325c498fcfae5882cb50c80b2317e48

SHA256
a289924836f9e3026b03f23c9d2bb6df8aaf7025047080af216518b611ab3e43

SHA512
a40c3f017a84c8baf1b26fdc8e56edffaf419a1b96219a57c50b6b7ec7fd95f2c34d36ed77bfb0eabdf6351c5abd1a54d5e7fd902ededea1c055fcdba45ea5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7514b677b3c9a20368f352c30b56451

SHA1
bf89ec6568be45acdbc9a5b4a8b58b344804402f

SHA256
dd4bc6af6a838645c1468c30a6541ab7fbd5914dd491bebd13ebe8f4fa69f709

SHA512
8ce08a0ecab30644808ffa7dbebec3a1c530ddcea8f62a7163a5cb87f90a013ea961e89ba728199d6ccc821106f84c063a7ea95f8447ff1f70ac4edf477e0720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f25557aa553aa24362b73902fa23dec

SHA1
83db02c04c8ea6d530557b9f90e612ab7e1be9b8

SHA256
7b212588093b7e464b1dcc6e78af409fbb339a36f3e91dba53d911b7cc8d969f

SHA512
5503430af57868dab76dad7c4e5b673315b84d08374facac5c79a9acbf634ad1169b44b8f10610e0c0348307b105780299c95b75a661d9f59ae0cd73550d70e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e455a82772c8318e453d865744eac50

SHA1
040d325f8f1522693063628e423d43ec939c6fdc

SHA256
dfe4c1f05a70c18587d640b19ac6bb4c8dbaf195793d75cb2d2d058607bdf0ab

SHA512
0b803f44d30b02b905c4a43bb564cda95e3bc6d905facd635ca6e61245d1a7e0ff71ce8ee7a471ea1b0655d077ff65b753a290e500bca72a67925b619555e31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e35a0cbbd40c7bb01498d61021f24b61

SHA1
36c8502d5ce317622c3b36f34527397425d94dbd

SHA256
e8d3b5f69ba533556776e1cbf4665079fc407c3be28c05be0fc9af826d87255b

SHA512
b3e237f812e8ae45f7c7f7ac93931de7516f40e11d06667fd8ef9a4d292748c440db3940dde322dafb9903619927af73ac57d32f7dcd7352957411346bc54e87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3100931e35fdef87778274cfb04daa3b

SHA1
2759678e8335282d39640ff9ce06e6dcb068500d

SHA256
1adc951b567b0e604dee644d92eabd1b72187bdb3c534270aaadca531866e84c

SHA512
f085b4c9e097e3066bba3051ad35fa3303619048cc28fa7a0f152448c951d3b23638d4b194744425b1ea8f6f7e14e0043ccf0dcfea64112ceaf11ed7368a4aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1251ce87b3602c68c4965723ce9f0ffc

SHA1
83269419bacbd5f6395aca015d3dc67692a59552

SHA256
f4378bbebb801db9a5584ee175e9619b87d4dad9ad47842fc1f6417efdadbc82

SHA512
e6f53e37b0ccc042d418ee60f92ebdf439abbb60880502a0f6dc36da8c2ddb2eca87d37efb24fe351ebdcea5a800a290346804e2755673a0c704a8fabf8667eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA93C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB05.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit