hxxps://account[.]activedirectory[.]windowsazure[.]com/Group/RenewGroup?tenantId=d5b43ab2-065e-4daf-ba23-3348690b5b3a&id=291f34ba-d727-433e-97b5-f1fbf960f25d

General

Target

https://account.activedirectory.windowsazure.com/Group/RenewGroup?tenantId=d5b43ab2-065e-4daf-ba23-3348690b5b3a&id=291f34ba-d727-433e-97b5-f1fbf960f25d

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371576258"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000003b1fae999b0a186cd4bbd100ed2165affb102802ef5f03de412ddce5e1e00184000000000e8000000002000020000000a6ed2c4ec6856e231f97ffb3e43ce76529ff09964cf09605fb1c0699045205b8900000000d5d7b37055322950d29062e051c53a3bee62aa2cb9b3f35a1340a1aae459eba0d7c50973037451de60ff50570c0d252141cf6f75fb41562a1ea00ae5ccc5627a0b8340e31a8436b56e14f69b4f509d2f787dc5f36e5daa28dc22978d08eae6a7bac8ddbc8eb8d44162b2d8f41e07947a80fdd7c7c79159148605096577f593185cfb956fc24b69af667f855ca1d889b40000000cd47b49f41bb8798c971e61b5aa28d317d5f1f871af1e02e02ff1c78e4e53b976adf97baaa7b9d677ddf4a39775c90b74bef1357a0c2ac3c3f8374902777604e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000c00e7cca1aae57c6e931f6126fb8850eac4ff4c61c7d1689ce205dd5fc3a8d11000000000e800000000200002000000094f9c2f898236d3ba36df396bb99a73fc3c5b4fec495692599d6f3744f460c68200000006b0d85ef6fe0208cc1109e31aced3613f183443bb7e27cf7aa1d91f0ea89fd8e400000003b7ea8147c4d393a109245339f603ae3325db8ad4371e08a94e5e23b44360ea5830352ec2220c599c5bd03374f2919d3492d56a7ea5951edd42a4c20703b0d0d	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1F962F0-4330-11ED-8C11-42FEA5F7B9B2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e4f9ce3dd7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1584 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1584 iexplore.exe
1584 iexplore.exe
2020 IEXPLORE.EXE
2020 IEXPLORE.EXE
2020 IEXPLORE.EXE
2020 IEXPLORE.EXE

pid	process
1584	iexplore.exe

pid	process
1584	iexplore.exe
1584	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1584 wrote to memory of 2020	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 2020	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 2020	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 2020	1584	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://account.activedirectory.windowsazure.com/Group/RenewGroup?tenantId=d5b43ab2-065e-4daf-ba23-3348690b5b3a&id=291f34ba-d727-433e-97b5-f1fbf960f25d
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1584 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
16f1c7e91971ee4e872d3bcc972782fc

SHA1
932798ccb7bbd91c92366009d87c76856bd6f84b

SHA256
9f654351fc7272a2d205a375ee3b32b239964e700cf30d2bd59fd109b4486a43

SHA512
d317f146366ab6de798229d59d62b4a77f7d0340843c01547b3b8201012c49ffa6738a277d572abd30729d2effdd140c0aca1f1c16691d8e8632ada96912f3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
6b5e9db3814a5ec9830dbf9a1c98eaf7

SHA1
8158762f3b7c4e48267dcd67ba734f691f47226e

SHA256
a188afca063263516a91cc86c0c1693b721020a191a2a5ae7f389d2a9cb293d7

SHA512
1e93488ddcbe4a7fdcff0d7c9c3ffa847fc317a801950ca04314b32fa2b83e516e7edd2578a72dbe7af5313ffdc105d9571ef315f8507ba0278ee48369074734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1evexod\imagestore.dat
Filesize
22KB

MD5
01d0c0a03dac39f8da751eccfb14e613

SHA1
4f9b19f250de4b16a5e32a573923cd8ffa3014ba

SHA256
7d4a1c0085a8dde74d2d1ad06592e79f1f51a2cd037581fad03bb997b4597733

SHA512
69345bb300739043e48e4a68d7c05d305977ce467f985d9041aba4e5bd7d85c98424dd367a49d846ce7186fb89eb0d95c6473e6a86cfb11a4288224585d6f9ee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\L3A3ZK3S.txt
Filesize
606B

MD5
3116cd3973ccb4820c7ecfbe192b6ec6

SHA1
723684d27b0d3a8c50e1f05d56fe52e6df94d47e

SHA256
bde01036c0b30f4701be94582095a1011d2454ef44a477c68f6664128377f668

SHA512
9810981b44c51bde8d60cffe933bf5332dd25efd382ce905c80bb38852aff0b8546150d6dd8768d1f3dd823d707d010953f11ce5c10304ab70a790320109f99c

Download Submit

Analysis

Sharing