b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/cache/templates/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10021C11-A67B-11EE-8427-464D43A133DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b9c638c2ad4c478eec357b229f17251868149f4145815a283bfb473853356271000000000e80000000020000200000007fcba932720a2193812f46721c7a713c0d35fbdbaf62893a6db9cf7ed81ea8f7200000002e16a258d4b27602ba1b225a1f6c91282d382fbe0c5605645200e8302ac24b244000000029d1ecd9e8c987137691a44908ae86b7a369a5f62c98f2014f9c4aa8581b57fb8b8301bcca82c2a61d6154592a16343c3cb9a58b556648cf2cab0a2abad96e15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e092d7e4873ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008ef7920a9f6a0c07dadf7d61b83beedd0037fc5dd1a81b0471f482d06d3a1907000000000e80000000020000200000004aaf69f175471c34956a9b701f78c16dfb734ce967ebd211697447be1429b15d90000000d91e4b560b877ea7b4f7cc810f24524f3d5164378dccd7edc6a2699372d14d7ac56e36fbc0f129f1d6f70b40848e58ca498698ec1d9257a2be01df72aefb6ffe8f6f49fb599db7a50c5b89e811ed4116bf0e38cc496e70ac4aa78b1ee56992039e43ac1d0c5cba9523c7242fa2e4ec6268f3ab82e0ab966332eb82be479bcdea906b1835969ba47c57f8f7f6430d78db40000000766c581092b5cd5eb2a9758017b9a37900122d05100ecbe576abda80ea7218e018041e78ce94d2a8683574d5052dc883bfb015c70fb434000648e37fdeda227a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410037668"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28
PID 1984 wrote to memory of 1976	1984	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\cache\templates\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c4ca2693fff8cf13b18def775326775

SHA1
6173385ba884d634461f0062fb06b43eca539215

SHA256
fec56c8b0bc31151b0dd7d6adaf35419629fb5a25485acd6ab76b45956f0542f

SHA512
59af509a1feac49f1a0230bc637d734b3bd6fca6b8bc9cf364abebbbd643febb775b50202df6fd635f7cb7546d6ce80287ae82cab7bebf6f8f8fe23d3c0923b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ecfd23de816bb4c27247589ec8601a7

SHA1
fde7a21c938f36bfa7f5d7cc1c2e2404bd88f7b4

SHA256
7602a7319fc7e7f8f190acbeace7a54a636c936ae77bef4893b940765b6da899

SHA512
890ac84c09ce441ad19c34aed3cbb04621410b5b3367e3fc18643af6137f2ce068b1aab0d448b46852b46c75e522f45c113ba5974ea6521e98fa359c38dc9cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb073ec1e42b33b3ca1ba559fae30694

SHA1
afce25d8d1883a2ac664ded4acd9892e21ab149e

SHA256
397de26bd0c0a5a88ad8e1bbe4d09a1c1fa7e61b583778ab43cb383019dc4c7a

SHA512
9a1f618fcba61239bc7238e1ebc4d4ec577fbeb9923d3e0e6b6181f1268d78c0ebbd6e7646e5769708c79c39f45e790d98ba5bc34f05d3b468dfc32a6a47bf85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd852c300329bbee39dd9c638cd9bbc0

SHA1
0374209f2e8a0e9c5375fa2bdfb9fed83539cab3

SHA256
16adaed9dd7edfd1c46cba78949146a98fd67e4857afd5cc0cc765ba13501765

SHA512
8d98101e0a992c1ad70ca88120d4342336076cb36261cabab9382d63c61ab85496ac2e1bda586fe8d02ec7ec6a21b37b7981937ae04bc70dbdfbe5846c2e1f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7ae240595fcad1e786456c08edefac3

SHA1
b2b68ecf920fea0e6313b68aa41f0bc22e5f315c

SHA256
1f8b1ff0c5a24cda4e58aadd8b02816d10d3daebcd45daf7f00330b899cae787

SHA512
7c353b5cc802c4b0f76b138494b3ac40d75d6c39ecbaa6dedf5a9aad69ff030009bba6dad6c8fd39c318673aa75a15f3c57267116ad866ed2a756eda0971f967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6a1759d6fad916385ec834e80f48876

SHA1
30e20d676267a0ec2bcf085ecb4ccb1e4c9fafa4

SHA256
7b617ffb1ffca3cf68afec9fb81b579b20c3b2c865bb0a2582ae2cc965c1f65b

SHA512
82201922b44ef3f3fe68ac5b8da568bbd87bbac4e3b7064f831349681e9dde986ea5d39097f0c4040b72da8744708f804f33d7f087430ec08d6c1e4f37542c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c44d305505b175aa5d1a700bcd5a796e

SHA1
1042b2746b600d7cb1d55ed80878692940a19102

SHA256
6ea331ff6fba2de23dcf0ff7399a130853cb3e23026a015a4e03835269d18e4f

SHA512
f41eeac69b0ee709966494219aa3af9fc60d0b77b9b09c5e9ffd8ed59d91369aba8e8f48af20f9d109c48da8e2ef5bb60503a6afdface181c1ff1b244bef0e00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28381173ffe69cd19619ada684ce6a69

SHA1
029838d11d1644a599aafaf333a6042656ce0ee9

SHA256
0e2e36d6998ad6878efdb6652eb3cdfebb7d2334c26e64dc343af843260682fa

SHA512
ee64f8e8c1b4eb8730a6c9d75142613070e37e53fcaac7d4ef790ba4920b879df69568001baa43da00216f8d7fa2624ea88ebf1a10fc6c4986c0f05906f81500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c947182147f4d57736d6dc8dac940a4

SHA1
3d81898614b782f5ba60d4a71b628562fec40854

SHA256
de6dc7cf029336d03638d44ffff48025923d33a544dac52ee7ac9434704bd01e

SHA512
6193780103b178bfb65fb4542fcf06d99df9a045ed442ea6ca557f183615a6dab302bb8ed3009f949da6d9ee4354904e97ca62d4fd5083e818e3e48b1f908c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2100a554af2e0cbb8c8d82940dfd735

SHA1
4a687ee90a715646e90393aa4ea4a23ffb46c3c5

SHA256
6f6dc8c73e26f92e5b5e8df980cde7d5b1a576a7e9015afa9228dcdb6a5d0aab

SHA512
7f5cafb697c79ffb9fd85dfc2ad2cdf57d3590d48f0b06fd11fb7b2b6517465b5062bf6ce1f216b0083df8be046e4362aca331191a342244df6f8aa0c6bc4cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76fe2f2de05874dc630b2e7f75753d6b

SHA1
6c602bde7b2207ff8e603aa559ad5deb04f4b413

SHA256
ba29b3bdce2bf4be025c921180a69e1c797f0219eacc2635ce8518a7aa379cf8

SHA512
dad5ce2c75099502469433d4358b1a92f00d75288a6311141da0ca615968538735752d01b8f407bc62aa46d67f3835a13a8de9c526a1b717cddddc9ebd7c8640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8c3c6db24b6f8cadbb861775f4abdba

SHA1
eaffc653bb50b30753b99b0a04af641e5f8d3562

SHA256
d0b118fd52cea8cde2532eff965cd2e18a93125825ff2a65484a7969d5e793ad

SHA512
05063122a5b3fb68126c3644dd8f09fb8a024b0a1f70c1c00e1f268066935659ad1bfba8adafd5253b8e5d77c5704b6626e7920ad09c4ba24f39faf2a1470108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9937695c7d95f39b3aef75f81444a58

SHA1
c07fc29a51481b4d768529e606a623ebc8c25a66

SHA256
738a8231953524a5487fac45d7af2eadd33fa596dfbd0b6469436013b6d55797

SHA512
384a187765238a80541434262a4e6f4ef7f104679446c74b0f0f82f2ebdcd5f6083b30ca83e79f1ba6f06fd3e7fe6b08ad9b1d0cbaa634f1e2c2398cdfe02cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB2AE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB39C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit