b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/cache/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8211FF1-2E70-11EF-9F86-7EEA931DE775} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7ae05198344c64b969915e4a8008f3b00000000020000000000106600000001000020000000a08c4da3bf9979570f14f93862fbbcbfd4fecebc8d3b80ed861f34946289a496000000000e8000000002000020000000c93c90dc8ddf735b07032314b323cc1b8acdcef52528d608260aa5ecb981bde9200000001830bc6604736320580cdf1ab7b3af7b05e12fdc6ab9dbe3dcd32e204300934a40000000c2813e8ada9d9bf8167ca169a71abd7d62d60f90cf9d7ddd54982380f801a340499b76ca86dc48292f3b5de81d37c16046b73c409cf84a4f5745e4b81c4e8ace	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424986698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7ae05198344c64b969915e4a8008f3b000000000200000000001066000000010000200000007ad35f30044e49906a5f29c093356b67e171e30c1c4aaeb56657412f1fcabc35000000000e80000000020000200000004d362806149b3459ab28740540dbdc6e8c85e9038c9ed269b13bd18983fa92ff900000003a0944852f84b37fd9e8686f64acf1148f73e48f75e2f49547313b5bfe67ea18c067aaba72ec6b0756341f6771d0c6437d7c93bd53e386f5b2b156536d9cdc024a4debcf8fc2c7de7cabcf77ebe56a8799c8c3d638bad33622998490c1f5c66294a22e2fa6c796e852dac2039e13e8a58740401ca5d94d7c1045f0a5c19e037a076701af75177b1681bf4f28264096534000000024f24f887c31afb08eedaec7e829746db9a814c671df52ff6552c39102642e98693b9c87babd26a593400487ba0daa2ab4bb0e11c976b15ff61d7ac167c40421	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104e7ccc7dc2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2168 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2168 iexplore.exe
2168 iexplore.exe
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE
3036 IEXPLORE.EXE

pid	process
2168	iexplore.exe

pid	process
2168	iexplore.exe
2168	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 3036	2168	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\cache\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ff9e53478fbfb344f507209071ba748

SHA1
a54c7f5a2a7ef484b09501a488acc5fd8ff9a32c

SHA256
09bd417b62e0834b1bd421c5edfca7e29588ccb999e9a7ff61df79f37ff7cac8

SHA512
f0f6398db971b5c07aa73f3fb2cf515e2e8da189c6471994ed797f57f7a9a9d7c3da9f8d1ac73c1a144495a322ac0b84285c42534d07c203dc3d1a579016ce0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bf87c34ba5c462079be549822d6fccd

SHA1
b176702899b7f1ac653c26c78e96447f376810ac

SHA256
435ddc7d8ee14cd81ea7af7fea16facfc056908428d953055d23c78c46132a8c

SHA512
dc3c588fdc2ca64df3d237eecf9b2e32835694ac2f3d11d762019f060d3916e9cdc0198310e540f187cea9818b40e59dac22cb1f802c3426a98698224c44655f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9a20d67966592fb04ee09add466b587

SHA1
29f851172a457f2dfbe6e919a6559b1100c84d62

SHA256
85c7fecd85fd4c250c3763abd59be5741a9efcd17d8a5ae1ccc0e8b6f8a6af7e

SHA512
3d5ffc9e6b91f04bcde6b430f5d37dce96341871764e95350eafd86134783f629dcc1fe41d7e14209242c3577d45d5169f50e241726b05ea8781685998261cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca9be738a9658b259e909b2e28fa3837

SHA1
7a99013934677eae1067fe963fae178062919d6c

SHA256
0c927acf022fd153d8d4395e90cfae2056fac65ef5bb5703358255804b413f4d

SHA512
e64875dd97733b252d7662df20b5ea882d4b28c1d5d96a492b5bded668e616f8cd10c5a3b634b9181e924f5ed00488c5c137f9f8f23daf4b878a9105df8c5fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f617b7eaa957c255108a7cee844941d

SHA1
f3642981f962f6cfa9f8546336e44bf9825cca5a

SHA256
76b25ef8a415c4537e9a5b6bcb5fa9d420589af194e9cc2a5c018b6f8adfb1c2

SHA512
cc47383267fef68ec990c0e081386fb265d6d2ba768042278ed25a43d4c7a108f24ab8129a2d34be0b92666a7349c943a2ba73fe0692788c8a9d3404f532f139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80949dc46c72ee5fdd784d80bf11f314

SHA1
cb7c4244bf65b72d8195d0fca86cd1cb5e8f5970

SHA256
0cc7b529b5697a89ce11065ff50c676eb6ea98566f706f1ce3488646bb9c301a

SHA512
5f26ac2887d57ece1dbf51e1ccdc001462394d15ea925a8e60c13b5dc83dfade5d2893eb7c73ca674515997eff1bc3e3622ed2b395a2ab80f3cf1b00f76fdfd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb2f1d295d70001d23f1fa55ef1d4897

SHA1
5b944f07fc9e812a4169f9cd12bf19cf5c2baef0

SHA256
76a70951e3677120d0995dab87bc196d73a1b0999242e767fbd5e5c93aa16aba

SHA512
4e72222fc61f7e4850cf5250c028271e347e63d128d2e04ea5e18f0fd0809725af12ea6c3259945466cdf618909d94777f7125fb5ab1f1f7d9eba57ddd1e9b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e21a11904ff0020dc6d44ce28f8fca1e

SHA1
f3873ccb802a34e11f55f7a4d4389f70260dc702

SHA256
8f973356b7569bb522908e1535d19155d99b57048207292dbe5744a81a925417

SHA512
3dbd52decd17fa49475f345db9ab08bd01d564cb612a88a9d49b58b78329005538e1f29c163b1375784034a538576661ed052708f933d9a84bc688104259cb58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06cd9156c5cd3fdd8261d9878d8ec86d

SHA1
465eba3b963ef818f02ab0acf69e3a267e67c8af

SHA256
a7dff352535acd79df7d0795ddbcba0130a243490b28bc4758681b6c8487b7d9

SHA512
e28f5d859be2ef069bb896c5131faee5db31732b6f50980cce59899f5b504dc0c0a4510fcfc292817955bcc45036ed424be183a01ebf2b781d4f028848448d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b18290411dbd548ec22e0afd279a9206

SHA1
20aea964f14b2219e766b4d65b3c573f16442865

SHA256
9861bde077f3604410cb14934e08ba81698d64240c4151b0eb38041cbda8d9c0

SHA512
eb88cb29ff9163b194d822ca5a71f0fd11e7f17434c54b484aef0456163865bf9d5acc6847d7108307a24cf70e6b8ee614de3e22ff8fe9f7cb29b076ab4f4fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12a8b72aa7f6e5a9bccfd2e59b9e60f8

SHA1
5fb713a43a87105cb1d74e9b82f877994232dbd2

SHA256
f365d74122b1bfbda819615148b797698571002a34a1328e8dd57c9e0fd11c7f

SHA512
0fa7b88f512e57a673bd64bc42e1743c4f1ebec3f813af135da4f917888ddf58ca3071e2b64939fda498f9ef1a8ae4b0089ced32239a212859669df98d26414b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
723828642a8d3dbda93e8ac7c167e155

SHA1
035c98bcb2a44f08f8fd259292bf3604a10084da

SHA256
c5864aff05ad0fd45e7e15f55a117f745ab17cdd61095695e823a296fb8cab96

SHA512
427454a8b649b7eba3accc8c6488645a311c9617f9ee84a9e71d3821fd8f155cc3e53ddccf2e6dde0fddc8a87388e743b4c649b3b27a12fd8044d9facad0999b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14a4b07e877c54b551b64dc0939c7732

SHA1
bdb5a4f2713aad31bcba4a461fc0a83035882566

SHA256
4e57ebb7001aa44027961fd7e6a60fdfec93593b9fd82de0ffc80ee88a89f61e

SHA512
bf4c0d8f3d9b90149428242c6ff6ab608c3ff2bc9f9b573877d8509121f547de8a9a7ae2cb66c84155b87a1b9b41c0c4f80f2fb454457a9237265d4f9788c225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d56d1ad27b7ece18627b8566ea371a

SHA1
f1ff5fb686145aa56c9061e113a0181ac3bfdf45

SHA256
204c1dad9da069f5fd03864cd92c36ad5ee13264bf2c37abf3a980012004f64e

SHA512
2f856bc7ec8baa375bb27a1eb94389428c179adc0f6229da5441b8cc08ad83ef5f1c72aacb2a3ca4a8b091e7f8192de06d97516ce18efc41d72023e7791a5525

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4155.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4267.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit