b81019d16d83197a22c34667c770345df756242aa5f17cca00f418a5d0360ea0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

akcms3.9.6/cache/tasks/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b3b4c537685253c7d40d66d9f37f761ed30c3188f1510fbab7c3961626f45321000000000e8000000002000020000000c28763a2cc7e265c1bb797ac4828ec82d36071226d2fafcb1c8516ef85f5a5f3900000000aa67e4ea34ea4f5dbd2c7f579197cd96f9676f8f23905abe8e637523140ec270f916afe1ab3a8b560b9ffbf065a024382e0b10ba912613cc82881572393d5fdcf43a50439e7ae0000ae3265217ebcde609f5d2a0be105c8f879e41038083e88e084b77dd3f3cc7e4165b804a7ed58933d9e9041c64a2bb37c5b4e84a7e2e67727d5d0b5b7112b0c225574a0ec22a17440000000bb7b9a823d628f2088c0f27c102d946c10d64513afb07f0401af82d6e413985296e7bb8e4801d5e4db57ead6b0ca3e6b4d9674b01f825e0385c3c0c6967ad87d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103081cc7dc2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F81D8611-2E70-11EF-B6C6-7E1039193522} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424986717"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000006716dc9bec3fb083450466ffab2612a2f5df63c1fdfe5788da7f32e00ca3f99f000000000e80000000020000200000001db424333b5893426bfcab9390619891ab153ccc98a667fe4b728ea5179dcb0720000000707226affb67804d2f2ce5621a7478bae7d5d8746fa428f2b4040dd86fdf449940000000c9a9c4d65ddb679c0cea22bb30a0470712af516f3aeefc30d333f851099dff517123f47e5f1fe20bf1bd76cff12bd4af4eea883b18ad28f87e13386c995063c8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1732 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1732 iexplore.exe
1732 iexplore.exe
3020 IEXPLORE.EXE
3020 IEXPLORE.EXE
3020 IEXPLORE.EXE
3020 IEXPLORE.EXE

pid	process
1732	iexplore.exe

pid	process
1732	iexplore.exe
1732	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1732 wrote to memory of 3020	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 3020	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 3020	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 3020	1732	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\akcms3.9.6\cache\tasks\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab1e7f54fdf2f6cd56a5599403ef3066

SHA1
ce379e2ac1325b45164f73dafe9b328a81acb836

SHA256
a799dd7cdd9f47b9b664c85ae6bfd4d8517cafe808a749a16575b79f7d40d909

SHA512
a53fdec1af96d491f20d12b60de13ce5d24603c1737f203a08f63b9461a7c0d23beb8634a63437b3388409eabc7cb6bc7dd31087a62c3b279f069cf49581aafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9b3acb4a534758b36cba6ffa241d2f1

SHA1
64e3cd8603bd82c3c6c13a5534c99c595f850fc7

SHA256
82daaa91383ae36e67e76c1e060ca161895658bfb37ebf2124575355a903a5d2

SHA512
2526bb0aff87573fab8d3f5cb8230c5c440912ef100c25698fb6727436ed0e7b689f506b0a2e4599f26e6b53b205c25c203196ed61e497ad9613976c0d3eda1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ac1f4a56c66e905f38c93a895a5890

SHA1
da276c5a2614d7659f4863e1175983f52d63bb62

SHA256
14f8394a9273d92918205cb981518377729905febcb94404f98f9655ee051460

SHA512
a78993fd0d193fca68cd3e398e446c1a0e6c0eb55f0ad556a8211af95bc3751a1ed33069587b4ca37cf46a47b84d6f5ecc589f4acf1490c1196f502f9e824c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b367c3f8150f63bc3ec33d460477c35c

SHA1
a1c76d80588abce828a56758fe7ced0c367f336d

SHA256
b04b21395e7baf0f9462aba4e5af74bda1db28536c0748aa14d50bdb36c1b727

SHA512
da59f0bf02903675fa51586b82ef38fd848bc7bb69e95c01a2740b5beacf09b0fe4953576580b93fc4d121dc6a933cd81d5d53d06c6a6e18c7e74b3d26d3dccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36396b7dcd641097221ad28c6cba1da1

SHA1
f889bc61d719ce5b6eae8c06a9f43b5d268c2763

SHA256
ee3803a30bc45fd92707c01538c733b3b40f79e6a898d928d26d3d77443f06b6

SHA512
3cf012ddd397160a20079a4a3d854fa6b7cfe733d620d60280e7d1c603bccd12550312878dab586e0d4be5a63257f5391eb87ae0f2542c2edabefc7ade48d74b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d1e324e072a7681af63a194ca0a72da

SHA1
0d4885af1d0d72fcc732d6f6e8c53a516efa5698

SHA256
4e0044480755c3ee7629434a6b78e5158c705cc32b47b38c5d6aa057a56df0a3

SHA512
15e041744b47b7da5e3f5e4e2ba021371a14f2205690a42682b844fc54b1a90a6fbc382103c143580f39fd225f79447b8b21306b391f2bd4de337f7f9a7fa454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c8ea2b961bf130e42e80ff2ab5ff34b

SHA1
f89eb9426520fd5ff753fc1a18c5574b00fdd794

SHA256
c1ebc38958a2929d5a4552e3c7c3222e69b2dca249c2ae2efac544f44a9ce40f

SHA512
bd1fe55fc4ecd55cf6795e2bb8c8a7524d389f039d57e856c76dc35cd50234fa690744af94a86293353e7c926f0f1b9094d203bc5d972d7ba11472d0f45927f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c737ae8ccc8fe1c6b1ceaf6af5eb2876

SHA1
0475242fadaa8c5281d2856b17936a228a3c7e6c

SHA256
56f27b83cde87a07b5101734cd1c01412e8d40caf2869531011dc88dafb22539

SHA512
1a605aa07431fc108b0f430fccf4a14513ff6bafcc489668cadf9bf6fda2239d93b57f251d13149008a4eb7729f54e68723b8bf8e33b39b750559ba1cc1f6f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3ac20bd760de2a05d4ce45500acf1e4

SHA1
09ffde9ac5610f0b01df4e5b3d448b90cec75ba4

SHA256
28c084dc7ca111923aab07eb1f5a3e27e9ae572b653c45a9e15ea1a4598af716

SHA512
2e5d2ca9b45ce67765e4ca67c085d8aeee1a42c1f2bde50d810f34a5f599e98e27ed275d8103ac8baafc64af4482c1de4abf2e4021abd84156aacca39c2a29c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0184c92d7d428fe69c0c5a5cd19ca7c

SHA1
308c7da6ec38b3240c9b0954a6566f9d13af85f4

SHA256
2ccec397eba508eb4379694f0f237903061f641cd54389069b4c3799a1517098

SHA512
05774321e61f30a5dbfe8d10172d8c29fd412a7604a4df2e563cb82a5d3e17dcfeb6d7fda3ba8f00d2aa9e927c8060beabb097333445e1c5bc92c400ca4f9206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f27d2aee6d8bb6c1ed6c62cbec0c9b9

SHA1
4a3e4e3a3fcc3856b0edc522376d6e85c0cea4eb

SHA256
292a2228451bb77ed59a899259a1f9dc2f3c9868318e5de4c6a46dde7a01cc42

SHA512
3006c59e2adebf43378b6fac261cf76be32ef9be61623b914d11d6f45b4a9b8cbe93336dcf679466d6153639680be67e8076edc4037df9d5b81d2a960db05ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2458.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit