hxxps://rfq-xlsdoc[.]myportfolio[.]com/

Analysis

max time kernel
92s
max time network
205s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rfq-xlsdoc.myportfolio.com/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000cad5a7f96ff51dc6766dd432634fb0e71f6b401aec815bbc0b2c591cec6296fe000000000e80000000020000200000009b0d14961e4e4c58e08360eab0cff927c55f71cb9443c570b31cb3793df65dd82000000071adb50e359a09ccd0936695dbfab71ac14586f04f1190315e31684e9fa1b2b94000000066ef7a7f8843862e11ed4ea3151c52e5a57d124f3be9a6eb5951663d9532a9862010ec08d017c8a6f7b5f5429652d3cd6f8a816236c0f6792a1d85ac39709f0a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700b815a51ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375982677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000dafb6251dbe706f0d1750aa505aab628438a902f75c2ff9a1e72fb0c8478dc17000000000e800000000200002000000093417ba636355c4bb31662f98c84d8b1f382d9214ec1d0269b6ef6300a3c0c2390000000719b2aa378d154a4f865f581a31195eca43c174e3f6159d2468502d81624124b57b1e32e811498e7b4d17e24fdeba085485eaa52d0eda46441c2e43c27c0369108e014c57c0aadbecb98399f51c00797e2b2836a5103e51cc4bc7a9c02579ebc23877e0341e3ec0dd21e09d296c967fbb540d2ad666797dd97a3eb17f635f876280effd91d9ecf71ddbe2551eb6f639d4000000053d099a1e008b05a0eafd9ae8e8e56edf399630318ae2856ab55adb43a53138f232165a1b71ce885452a5e65e2f028897606068976b73a66e401b73acc4f45f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6514B731-6B44-11ED-9BCE-5E5304B417C2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2012 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2012 iexplore.exe
2012 iexplore.exe
1196 IEXPLORE.EXE
1196 IEXPLORE.EXE
1196 IEXPLORE.EXE
1196 IEXPLORE.EXE

pid	process
2012	iexplore.exe

pid	process
2012	iexplore.exe
2012	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2012 wrote to memory of 1196	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 1196	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 1196	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 1196	2012	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://rfq-xlsdoc.myportfolio.com/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
71469c4109acc74129119a8f8aec539b

SHA1
50b7731f3064772f06184b306844db1f8a7b75f1

SHA256
bb18af6a629e578433da1d3217fcc6d1a8a5a7f792ffdb84f081f1d23446cf4f

SHA512
9820f73c12d63460c35a9f13c56b527d2137055603798b9b3e72681e2b72d055b401e26ed6e1b810d6fe2de3400b6fba4cbf3abc326f6e4523f7b23891c618e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
aad6a97d04ab1ac44ff182ace0316451

SHA1
e898338e362a13204c335abb55c378d4f95bddba

SHA256
5b41d969dc11db86a1986dbe8474b493009dbc4ee66a403a8f5f5e80e398c080

SHA512
6ad8601abd3d970deaae887b6fd17a57bdd37a1c678ba948bf4d7ea7cb7582af811ca1f24c9440928690bd13ff746bc8051255115d836124cb86eb61cb5c81c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
498c447bf22640fa24cda2fbd7a3491e

SHA1
c0ec24ccecc0b5f49d8a959b02511d287569af92

SHA256
b62f99004ed13e659e8bf92536dbb6a814e21dace5ef68c6fd28f40523d35ea2

SHA512
700967494366d365c29cce522c86321ab86c96592d23a3f7e2a4c900de9025cbb9734069a03169360b0601306c53a213958f61fd8dc1efccbf3b91ebf300130c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a12f63abd1bd9deb64d6530d9e2ee4a5

SHA1
adfac6372691b40f8684eec949fb065592394631

SHA256
7343171723181690b87a8517d7caf21ec7f5a54a98400b1945e2d9cf3eb2ae73

SHA512
befb2d3e293913488cd4c0ffc8af8c24c3f070bfabadec666e8a9eb079e6b62aebfc366d0110591a2c2eb0f1f4c8dd45c04ad51060f67b5640730bca2051fdcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
407f6b4c70bcf29a1afc1942ddfc0efb

SHA1
43a5d3e062febc80ce75b45452c7dc70e1a13eca

SHA256
139c0010e30849f30dfeabb8c3720007c45f9f81b5cd8a3e04c88abc57f2af89

SHA512
1985cccf408dce180814df868edfb1a5f65c2c1ad9c46da6f4fa21ab7f979a62637137f7cac143d5930e537d15f28f0b7ae6489e36c6eb66436590f7fb5f160d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f0112f6c4fe6f2286783db2648b7caf4

SHA1
68d890d90788acf1adf162c7e63f20cb9ec52efd

SHA256
2f4cf7e226da1c71235843fae243f922a5cb651bc64c02551be8334d2da16164

SHA512
5bd1d075e639374c576b815f1e2b049a9881cfe20cfa1070094ee166d70a147dcb5fb251cfdc0987ad375b6fdef76eeaf86a8ce01e4fdd7bc60006259a1a3e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b2d6caf9aed5f7924f80d8381d49138b

SHA1
daf56b2175093bf564b99b01655626975c9e66f1

SHA256
b3e9c15a15c2f064a806b0ba9576bf1624c5df6e281722e739b4fc4081ca4732

SHA512
7bd2cb0b83c4f34fb42dc31bfb692630e009341a2d38f363ace02ebde4a2a0f3638ea08b7d519f73baac5a9b58bf5670cf334c6cbcae0d75949bcb175ac85853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
72465870d6c387aed35bede559ba5ebf

SHA1
da4e7653594b78dc2c594435c1c71a27eff9b5ce

SHA256
1e21a2e5eedfe541d9b6ed72454067d5eb5295e7126745c31562278eeb0d36f6

SHA512
1f7f15793d6abae8830f4bea19f0c05bc3e7869f6821fa246bb3788865b7fd12d53edd7748cf644bde96740d239aca9cd5c1e2390598c148c89f05df60e3d8b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ffdad894b00db87b5c1b8cdf3e52e75d

SHA1
3081664e4108289590786c3c34af425afdcfb727

SHA256
800fc508723be56df9d4d4b833bf55135166ab2b6b81afd5ee46ab5facb0c0fa

SHA512
406872f01f31ba1d19e952f87986bf63dd318031bd41b11b5831a7c906b0ca6730affd6d8b5db9cb4fdfe06cbdce680f0bf08d83d514b8cfacdbf6d021b8e8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1wzfztv\imagestore.dat
Filesize
692B

MD5
27b7e91bbaf7284199ddb2a7f732d6e6

SHA1
e168dabd9eb98b26084a16274948189b80460a7f

SHA256
a9d2ae59b2e0e40516de7fe9b9fd64a0af058b7720be7f8e6140caf651761d8e

SHA512
0ded05116812368bacd063742cc272fe519287ab4b20e2e085b9d0d08a2f87080daa2a4287f42629299e3fdc65bf974a9104d13f167a203a9fbe9090f80e92cf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NOXR168Z.txt
Filesize
608B

MD5
06ae2d1f44aafa1c5444177ffb8e6199

SHA1
ce8f57f21afdbabb32a6da83deac88dacb83356f

SHA256
32441c8a01afab0dfcdea61c2be3f835bc021b1c239587fcc3a7847d5d96b6ee

SHA512
d98d409a1ba0c550c359b0292487e42c168d2f6b51ab6ae32ba39aac32843105ea7fc24ec4c1d0cbb83c387d2e9636b3ad4b6b21fb897d6388e57816e577c5bc

Download Submit