hxxp://login[.]microsoftonline[.]com

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-02-2023 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://login.microsoftonline.com

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C6E3141-A301-11ED-A4E1-5E5304B417C2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382111232"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d1f35d0e37d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000d390aa1bac90aca9d98e0d00dae10b3f987787e5118e78b1dc82d0582152597a000000000e8000000002000020000000c0789dc52d2962a5ea1f357ff4387450eefeaee2ba0e7329ec5a37c8258ac5b02000000054c8054e77675dc580d6cea76e065dbb3eeb842f43f6b0b0e6a02df1b56c3f7540000000be3430282ca426241f94762a0e292b23d138658bfd918660ed785cff8c99ec80f5d881117bc742ec0fcf7c639c0d959b47a9d8c34f55b27b2d554026d5d9d969	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000006c79998b0f97f9e7199142d4424f08aed71d21c551e34b08512dbcae336b3968000000000e8000000002000020000000e2679fd8e470df43a4acba32564a4743ebb55f91d51e9e0f92aba85fb242234350010000661103435e2eee67d98db96ba29416800dfe7ceccd0b73d656adb4b8e7195cc9ba03396649bc59647a0dbc0f84a187233a384946f27d0b8643172e7e3a44bf951f51e317f0256fcef78e60befde6a95ee88230b118524a77474deee2ed964057426f4e456fbdf58f8c76f05702fb5bceeb158a5aa2691aecde4c1906ec3ea9542c92b0c88b2c88682f4fb5104e11b093d93335e8d5710055a2707d06cac6db61d55e19c5bffb9bf8b31ee9af9d65c6d338967174b08246473c00424ec398f51c132cac61b3194bd0757f5a7d3c2e31c45e4bb9f1f74e59795638a66b3b7fdc70186c1b83fb6600e5fbc70a63e974a963d32803fb56fc73873a31192ce82e31d2f02e5eb3688b1ddcf9ebb3981b74fa3479221ed23aaa220f9bf55a53d2d85b3c81e4824f5a87e4f889e9003ded8cd1b34e88e5c017b33c639c224ab5232b55a5f364b3c9bc416abff28e4bc04110427640000000852164bafffc9ccdf053150f0845b5aa8c8bd206e473139e5748313fa51000a3a9916677699fd3a5018a1bbe47932a3aa189bf3a13064883d3eb203ea931fcfb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1244 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1244 iexplore.exe
1244 iexplore.exe
668 IEXPLORE.EXE
668 IEXPLORE.EXE
668 IEXPLORE.EXE
668 IEXPLORE.EXE

pid	process
1244	iexplore.exe

pid	process
1244	iexplore.exe
1244	iexplore.exe
668	IEXPLORE.EXE
668	IEXPLORE.EXE
668	IEXPLORE.EXE
668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1244 wrote to memory of 668	1244	iexplore.exe	IEXPLORE.EXE
PID 1244 wrote to memory of 668	1244	iexplore.exe	IEXPLORE.EXE
PID 1244 wrote to memory of 668	1244	iexplore.exe	IEXPLORE.EXE
PID 1244 wrote to memory of 668	1244	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://login.microsoftonline.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4ca2ee322f938cae50111709b4bbb160

SHA1
483f122fd63950542173729bba5c2e8fef37cb42

SHA256
38ad7bd0a4a1ea0ad9bf812ed0a2cfe2134e2ecf45cd4d87a2f5753e204efe18

SHA512
759a09accf5c569210bffa73958510098f5ea7d67d2afba0be435c25ea5775213eaa7422fd33c181c5958d139dcc15983b8cfd732bb2ccbd8f91a09cf8c2aeba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
794fffaa2dff18de4db1048515a17369

SHA1
c28457ef1f2b0a6bd3b4d938f60d74537945927c

SHA256
7b8701a8e1a6e811e2365507c733ce93a30ae6a163ba92186346da690df9ef2e

SHA512
0717b01284753d54f8058b16499e2e0785a8fd968fbf8ae2468a27838dfe8337c7f33f059068f4149a491030335df9f25ccb5aa35771e0a7f5598f6aeecd4f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
785a563a0af07d6eeb4e7abf22dd04b3

SHA1
f27a2311e42dd40fe42cfa1d506354d7909fef24

SHA256
0ceeabc582c43e843f6c6830f649d10c45c48ae8835dc69843d5b7bcd6b6be31

SHA512
43f7347ae247c44d4430a846e8f7ec7ddb4da4099bf989db327927fa92e16a807d405442cff3230e7dcd7123a4f505c8a4e82f31c7838ec95aa0fae807c9dbcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
df75be1b4338d1fe6811d3b3b40107ea

SHA1
e4b90c1fb57f7f8388c704fc75b7ffae8f9db529

SHA256
5d2bbe00350c9e90a6c9da193b5426dee172e7db3a37d4d0b4d8f78a9d4bd9b7

SHA512
dc23e3f837eed9d8369d8563d22068a805c0085bc836a3ccefeb38a3387d930cad3dc6d914f3cbd40c9e0376eef977abf530a98fddf48f25601a92df7bc2f01d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
4490e8bab639e4a8af69a6c11f73618a

SHA1
638d258db045d62d77b09782c2fa26935aef76cf

SHA256
ec17d8a656f467ec6603c6c36fba1db4b28399d8f23540aa806e7b231d3e0ca5

SHA512
a32f8e8fe989e2a86680f505d8bc9c37265dfac7a417e9778e8bc9ec39d8268d8285cd70387e88d042e2c80dafdce16892fc995902f347ed999445e9a5c1e3e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat
Filesize
18KB

MD5
2a76aa2b8438c034587532f063b195cc

SHA1
50f568ab473bf3193357a82933a72a56446381cf

SHA256
2cf9b844ca45415866c84d42668dba6772574718df38a0af0360bb5b14c492e8

SHA512
8bb6e2e9ac3bf119763e4868fbd3ce5c989efa71e01cf1584a83be0c7aab95ecc1c9abfe4ef84c174b0bc1c69edb9ed8128ecc2fe1e95a80fe78c45e1cfe755d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CDGHJBQO.txt
Filesize
604B

MD5
01c896d20c7c40e3b56f28248ea36900

SHA1
0218e99067ac03263b6db9a4e68b6c87393b4ea4

SHA256
7762e97dd919bce454d396b32512feff37f388215af64489cb8eafb9306c92fb

SHA512
eebca16d2a2b96a9bd5e1ed433ef589df585723c1eef272f6bcb6153a4cd8e77cf31a17fe24f64ef92b3afb8bfcb14c5b78eede11bc9b07e6fa16bb3543734eb

Download Submit