hxxp://detectportal[.]firefox[.]com/success[.]txt?ipv4

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-08-2023 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://detectportal.firefox.com/success.txt?ipv4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000bec3f62f04199877c6def84d35ed3d9cc1cb6e7f32b1d2e153b8b0b626015f48000000000e80000000020000200000001d6770ae32b28e78a3983071e0e39c4ca67fdeca7ec7d6cc532359da129f7b879000000041e6e949a6571b6b6c77bc342ea65e5af6906e0f9155d25deacb623a9d203fc360f5b8a0dd3361b751096f7770e2c4f174ffac789920595ca53d29ca5db3c96fe95c26535331349f17597c52257e9b7b5d48c2b49fb2e654a55fd605ea5814b04d511e13c4fad038c8c6d7a32cf68601aa173a102a97c996a8289010924a081e3c7c603f26b3d60638ded53aa1912f8f40000000fb04a4069a274f51b06a951cbd607676d522a05c7eace024773a4087f37682c0272dca19793d686c8727a6483ef96c4f91e78f2a1211913663cd67d63c804db6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A140DF1-42A0-11EE-8D94-6A17F358A96E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd82794000000000200000000001066000000010000200000001b46f5f263315da77b5e32d12d929d7510397dedd1d0395d1056323414e42e5b000000000e80000000020000200000000de304d94d5c1c4216cbe54a9a2d0241fb561bedf947d1370665eccd93e977cc200000003c42047d187e06a3cd02af9c02516068ea6e5b6c9e085ca6180a631b36e80193400000007371ca1c3d910c8564c9bcd4a3150a3c880fb94c9d3e185510bef7f178fb668f804e15e273f0b37e177b500a7fc87440cd3823cab3754369ff4c4ed1c2db53c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f8f200add6d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399058484"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2376	2320	iexplore.exe	28
PID 2320 wrote to memory of 2376	2320	iexplore.exe	28
PID 2320 wrote to memory of 2376	2320	iexplore.exe	28
PID 2320 wrote to memory of 2376	2320	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://detectportal.firefox.com/success.txt?ipv4
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e56ec378251cd65923ad88c1e14d0b6e

SHA1
7f5d986e0a34dd81487f6439fb0446ffa52a712e

SHA256
32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

SHA512
2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7475f2dc49889aae495a2d1f292bcb57

SHA1
e9e7d3e6d00a0a634d62e43d5c6af9f153e115d9

SHA256
515749ae4560e9ffa4a3133d641addbfce18cc7adb74094b0d414c87f1745b44

SHA512
038d90cab01491e61f8ea5fc91020abd7b4c65dff44c3333abc78915c74cc5dca6d5e87016919fa8f62701634f86277f6c239aa6c511f13bea6bfdc459fa1e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64529bab703b71ffd8b21dbcffbfeff2

SHA1
686c67616c69d83aa8474da59cb4708c7fa1f6fd

SHA256
fc92f8a34bd51fcf0d2c4d3009bd15d471b21263b10c5a515d8946b477662731

SHA512
19a42e7d860ca32ed26b9ceea435fefa6c793798745093b2bb633ab6b7be01ac9fd89f5f48afb1fe0b3fd47bfc82a22639b3f09e14d6e5ac0a6c53a9b7ea4778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c4bcd249abdb8c5d309cf3b10e4d715

SHA1
4c26ee6092a9fc2ec642c276152c7dad054f04bf

SHA256
68d5077670ffa8c51ff6aa45e4c55db426f328c75742580f3ca018ad0f8f92c2

SHA512
1cfd29404d5537f790d04220b7a74e3e0406ce7542bb545fd0bf8a9e6cb7aad3090f0c9cb3891ac607e955768c2baa5e224cb981e18d9c3b11bdc48f31b7d1b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a7ee41424741b4f3012454553c8c131

SHA1
4e8931ea64ef0f8f25fe10a4e53ab7bc9a24c6d3

SHA256
2d8d5eb055d58c351d00239d68ef3e8efb4608e959853183e52959d020a62a8e

SHA512
5f110850fc9e7161dd865b74e3c628cd454b2252dc02c7fbabc851a1325dfc3ddac34f95da10b811a5308e864e0471de5ea214bcc957441f4c90f30157a2e851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e74ed33e116480f74eebaf0d5d976663

SHA1
54d14eac1e90b761634bafc452dc1e5e2ba126b1

SHA256
eb85ce04126412f414a3e4e33f3dd8d52ea0ea6f3cd0ebb97b049f91e1ee12c8

SHA512
66f699bec523b1efa72fcc371486b2c60da502364337acbf0daa7f42f9f8594584b0ee9759b6526c5c5ad4eece4a65f32030288ba85e2aa9a0f9e92d0c8e5c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3f1880df8c56bbf36779ca7a50ffbe6

SHA1
680deca9c829473d73c3ee3448cae73492f019df

SHA256
364cb72aa5bc32dca1ae6a4bf0af397f3a49cdce8bc669a5b61ce6cb725c79d1

SHA512
c52331cf2c18d56500e52a8b7b4a6b844e8f9e613bdbf342a7cb368f6feef6cd6e35de0b41ac0f8c72cad718a18e27c19544a1607e152d994ca6adf228697240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a7b8b5db70d0428670ba92fd8f1824e

SHA1
0461cf4837aeb9289bee3b8d148e4aa49975622c

SHA256
df4820c2f396493f13303f192a574c8bb8165732f1e539a84aec1b09922cccd1

SHA512
86a5bc30bd77cd656d94048b56b0db9ed788bd2889e243403c3016146ce03f1dbfea24278c7fa5f6b660860b3e3565048c8604c174d45b1761e73d6b4c163b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b899493eb55d81c58c2d9eba681bf1ea

SHA1
95d56c347ff3b1dd06b4e2dc5cb2a9a6fa134807

SHA256
f9ee4bbd159fe97a638de8b165927e47efe5e1b334d91e32d59f6c1d9d897254

SHA512
3a0d60da11d417a365cc7c57ec5fccb10feadc98c82048184239dc5d7f376dcf75b7674a5a1baf0f85117dee7ec2e9ec804bc7a70840c6ea9fb32f34a29ed35b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1da158fb64175afe832e05c9401de601

SHA1
84b0d5de74d77d22749c8f88f9857d0d394180bc

SHA256
bb348df602b9721279d87245c5c14e65e68a0087b67f32d8e80bcfba1341a683

SHA512
b2db6aa825778c6c2672c440d51157fc1d14e84474e14aca4fd0b9de80de25258fa17b181a11a22ed5798d4cd20142d7d0275f61186de497c3c5b7ec8734a8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe6c4e4cbfea1dbc6e8f88da49b70850

SHA1
add8c56a9ec7b57b9e09f4b82a7293f24baa6b48

SHA256
33d827c32cead56f4b34e0b828298cbd2d5f728c99a52b4939f0277972e282cf

SHA512
4ce8d42a13ce6a0bdce29f1547ca35254a28f54ba8114e49c8ddb194958e98f142351c6c88aea7f9e452eef187114bdb2cc892e23f5b7a2e04f5d5c53e2ffde7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
038706cb69dd20ed1242315102fe9295

SHA1
296b9bf409fc71859532f52d60ef371aed971782

SHA256
772f04aab1e5408b609340fb8c8ecdcbbd0124d2e0807a4e1987b43682a3313c

SHA512
ac63a271adda2866d1b1382be102d2670956e497be6f67f80d86d5f5949f8e76cfd0b37a6485a14321396ea4f9d7443053a8ca1bb776c69503a56a6425aab3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d6e7332fa512ec22db6c45cbf484c46

SHA1
2d8bdc6f79bec99bda0d4a25b03038eba42d3bb6

SHA256
d4edbe9e180869238c2a5f22e6edf5ea75f4fab2e841a8df242fd496890a8711

SHA512
c002229b4dbd74f5ea8913365aab2c887c3510b13c7fc736c0bfd9f9d597cf48a21494cff9064b7484aea15dcdc91b1dbbf067d324efeb9129adb2a0ec1fce08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6507afba7563669b3cb3bfdb21c87e85

SHA1
b4c6ae7c6e32dbce2f277ae16bbe4a6dce2b9562

SHA256
54a9f244d5c07c3d9da6f7caae321ea961379375316a52061496313007fb3564

SHA512
aa9ddd82032dfe5413dac142c3c8991dd17a7737928283bac235dba9f98f4fdcd56e9b747f74a53528f6fce737bd05c17c315d8ac8dcdebaa1b48f0a4fb0d22e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02ae6d1c133aafa7f8b696e17993e5e4

SHA1
d0a7005c3d56ab75233754b01f8ef76ffa2e3d72

SHA256
ebe008ffcc0b2b906e5ac09235c0fdff9ab1a776557c0d9d447a04ad8049074d

SHA512
a920c085e4373685adbbd6ff942ee4d69417d4af30a3b0b98de4a2d02b698a2313b56a509299c1ae0dfc291c0843083494faedf2d8468b33e9e594cd34089c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbd471686cd8908bbd4c2def4258468e

SHA1
81bc0a8e8ca6ca76fe6903cb2da6a89347812af5

SHA256
bc8ee60db4449b5087e68b894f07efec4662188f18ca9727d5759c7e5e984b11

SHA512
b4ce463deba7b41fbbb6ec350a9667ef7b192c20e29e4c372fa616b3467a58b18cf834c76f62a6cd1e7b0b0aa0c092daf0a670aa6c2aaa217adf72dcf4914e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFF28.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar143.tmp

Filesize
163KB

MD5
19399ab248018076e27957e772bcfbab

SHA1
faef897e02d9501146beb49f75da1caf12967b88

SHA256
326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9

SHA512
6d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103

Download Submit