b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/configs/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008441eb667939c7f1f5bcd2ac2886b8f8389a6a4c07ac0526ff7150068c849e79000000000e80000000020000200000006fa39e4af12d8c7d92eceadd3b77ede758073f7c430a01c1e7d1abafa62db67420000000379d3fbc5cb4d9ed12562b6a235838d2ea1c9111bb0046f46ae0d33821033657400000009a68aac6f1c6a1c32e092f5e231ba45a6212d844d4e2a66fb42b5680a3edce2c811fa4a67205311ec024bc58ea7cf089e9425abb89c188e4f00e2428821827ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F695E81-A67B-11EE-9D0D-D2016227024C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007090c6d82032f7500a924cbbf7d0b26107c6a43875a3cc2d40404da482145d28000000000e8000000002000020000000e427e653717435ddd974e646b87abefed8d46d09c5a937296e9178c17d14c0a490000000eac11124bb2339b277156b0e4e1d831eb5905f11244e32c06bf0eefe7bcdd69bac2b93594d8060605e8460b3ddbf25f3651d98938b3d450856e649176a1ad426b5bf42f6199f075141a5994a37a8422523002f2f21e0f102fca8c098520b1ddfcad53f2bdebf5adb7c79a8776c5b1ab1ed6b3d2c729dad3f0f57d26a038c3a61e81934ec2c6850a61a5f455d59aead27400000006483f06ac31d7caacdb1be4ca716a8b28be23da38740572e57f279262d5fe8ee64a134690ddcdb0504e22c30765b2d1e887e49ac1358c542cd8205a9bf558d2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802c44e4873ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410037667"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28
PID 2300 wrote to memory of 2704	2300	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\configs\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f7733cb1c8d1db67644064a8364297

SHA1
d5d0f1c628c1edbda2be2f8f734ffb6e33ad2bf2

SHA256
1ab45105dd8ac6fcf1fc987096dc5876d499e16b2cc420346fa2c086284e718b

SHA512
421b9aa7873dfca0b7a4a0a38a894593bd840f87f701a56ae204d849c7bd23763d4e61d8c93b67973cb8fe92d630c9d4f7e9a925e6e2aa9c5d4cd5b9d7a7a74e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e7d2d6718e3c088add009df3eaec909

SHA1
ed42aed77414d33261e913c26adca50dd8e99d36

SHA256
f53005c4edfe086e3fb9eb494885b8481033518e2acb71e93a3de248d6a65ca3

SHA512
91f34bbc06caddf19cc34667e4a897fe000b67386ec65f310b6879c05915e5d7abdab610faf2a7683041067b02518c2322fca8bc9697e2953f92549cb639608c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
264798a651a1b8e9b6c869e7e0cc5b0b

SHA1
447031581122fe8aa31daf46f9422bc5f180e233

SHA256
c9ed4452879cfcfbf50f2e46f58557bd18d484894cb445f11d77d36cc2c0225d

SHA512
4b0aa8d5bbeab6f5e31a2f3f7150888940d06880845f58464e0ea948b180ded238248508ecba23f9c585582376309b3a18d0bbf10fc6a6ff93d17cb3c7f67b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6f00116ccde4376899a3fd3b84c8a85

SHA1
b1d57162404829a2d7494ac56458605493ef5df0

SHA256
f288a48d0c7054cfe2203cb3e3fe6a8ab299698ceb11e359851e0e3d8bd85d3c

SHA512
2692c1881d2a7275d0ecb0c3235981c60cb6a624fa0462f88972afdf2aedc761a7a2862c8476c64e6687847d7d5b0263235341ebcab0fb31dd84acc89e82b686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e226fbda3ef938f2608cbc5ce8b13550

SHA1
c43a2a6daaaa623141eff799aa6f98b8a6976189

SHA256
40129a12d90ccc34873543023533fb3a9c7a91d5b526d75b42748224039c7838

SHA512
b809656c7cc45712de483d2b66b307f5793686c5f17df9d61ac3d29d8c956a4ac867d849509897fd7d80c5d2095a909b455bcdd7f9320419fba0f8c6268b71e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f5a9a599c6c63abc10459321185c2f

SHA1
705fae2a8a543154d1cd268c97459551788f7d42

SHA256
6993d6e5f12bc5dfaf1a03b7ea6a03dd1e53983cdcf0385b7be2908cb85d6f91

SHA512
20df88b5c31397c3b35d363c264148e01c2a02a1f66d0ad1a6133667fdd0638018e08c69f9429e7f868dbe089fbc12f0d7068c74bfa86b8480e4f465d6d00207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
445d330d0c3bd477b7581cc7d127fada

SHA1
645b913eaec190f36cb83ea8d063d29faa8f7fa7

SHA256
1f82a024fc8a6c95e0cef8147eb6e9108ac199d9325c4fcb34c702a76293e404

SHA512
ea6ad629beb5ffe5fe3d8da3331c79b7c317ea408fdbbb110bfa5923ea367cd137191d634521dcd136aa68af66d09290b4953116bca66bcae7436543cd56d729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8756b91a3e90936eda8dd3a9296ec1e

SHA1
72e2e554d0721213b465266fd480077da4b2c304

SHA256
cddda20f92f64d838598e9da7fe8a12b1e4ef830f1b2897c6a0382b3aef932e5

SHA512
20231adfb3437ad3ac7ec093ecc7e9caf51d5ebeb2ee14e7677a9e64790d708f3a5aa9ed9530bdf747ed484a5e38acb834058c404f18a3044bab73125660540a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2386e9dd4dd665a9acabe6a70b122048

SHA1
1351702ab3c6b08c37c7684c3391ec06b417047c

SHA256
4c7940d753036495a319a3c0f52ec836eb2a5318a73fb42761cbc7e1e6b296a6

SHA512
84a7c42a9a54a307baa247efaf891b29282015d8d84d27c855f1de6856ccd258dca4a602f98df024dfdcb486c8d83c3542b1fffaedb8f3d86637ef6d8e2f4524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e96f826aa9e60dc91aa139894545c0b

SHA1
ad793befdb559ed6b72727adddb7cbfb19f0725c

SHA256
cfcfd5c7f428e9f8bef757aecf64cbf7461827c4714688da3d77c897c87e8ce1

SHA512
bfd2a8fc8cd7c7f4dd2705655723ec1f723ad10663152a1b78d10fc901e4b8b87c939abd800866d352e4046ab5209a83f8a2986b880481fb5d823b1ff0a9a23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c961ed0c87991e13d7afe73f000a9a5

SHA1
cf02ee98d0c28842e58aef5a1b049a10c2a44a6b

SHA256
92952861de10725adc68aef6b0ccf68b1de501b0fee16a3de8f442ff0c2db71c

SHA512
ec2fcc2d97a889853cc1bf2cb4dd43a2ff7d46fbf39840f81f62ace5b73f9ecf2134354bf30301dd734395022a44e11c7be9a27fea10dfb6b7bb32fb67f0aaf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae13c2ee0c58efed7e1fdd7f8368283d

SHA1
3689bec436b6d030fd2c950708e2129c39a90970

SHA256
dd928b58bfc664d179231264036f2236b3c67e153b39dae13eb009911fa19a74

SHA512
a154e3b1b758ea28d93798697be2d14d087eb0275f79b33a069bf0cdb5245b202f4e2b1f16997cb5de6d754f61f90bd1734131c760472bfa833329fbcbd71402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb83792d8ce7df21f9759a2b45a285d

SHA1
997fe4ac082e82319b3048e63eb157b43dac2d8a

SHA256
cfb8472cc30e9606c599b2a1b5e9445a540887d79a7fe79956b0bbacbeb4f5b6

SHA512
7abd9fc03dfa3866b1f59d585a787303fc3c496afbb9a908ebd53e609b7881c3ad28c752e1b38c5f377f754ff72d18115b6958ac9a9900109f37f81ab23e7045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35b48f5625ab66e6f1a952b419d81e59

SHA1
17c3d75cde45b066ba113659ff7187fce2c0d894

SHA256
da50b89828b8eb772358e51c8297e19b6cf32e79eeb9961c18a2442ddabd62a8

SHA512
ca44aa955c805c46030eecb5fe2d07df097ad19a3fe1390c5a7beaeb9eb2d4c199091f254b965d98ff741effa198c92d2be4a264a57213486a07a61c5cfbe519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
432523fc99c76b15d26005bf8a2c3f68

SHA1
ee0127fb03a96fbf2e3c8c7cc1d174a167bb6e82

SHA256
4a57bf2ac353305c1d7747f6900b5a90a16a00d66785d5bcb90ea2671545fb17

SHA512
6b1678109c765704fdc4bc2623d42d08044f5b5f9c1363c5555682e713c68c117cfe120da72fad13f3aa94530c8a67e3f1b3c974cfc4c6f2807ddf97493f8c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ca901ce4a2432b6cf21ed6a605b0526

SHA1
e79e3dcb1f8111cdb408f6747ef901de24bb9bde

SHA256
9ba11354368420b457741bbf23d7f2efcc5e99072010a4ceb721147dbdf4f90e

SHA512
813617997841d35fd9469a2a90ab1f1855caa471e23b02e64578a15314e63c3eceaf5d9f0da05dfd146b7c14fed9c419458e92edd399e2d74621279dd2809529

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7D3E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DDD.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit