hxxps://pub-14d6971b695f4478806b7fe0ddac5ece[.]r2[.]dev/loginofficeauthpage[.]html?email=ulfk@regering[.]se

Analysis

max time kernel
69s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2023 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-14d6971b695f4478806b7fe0ddac5ece.r2.dev/loginofficeauthpage.html?email=ulfk@regering.se

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392900424"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001d11ff1fb6604945898027f66c60145b0000000002000000000010660000000100002000000071ca404662ec025c56262b5264cc839cecb4317c666d04fba5bac8067ef4f4f6000000000e8000000002000020000000a7feebb51eec439dd4eaff06d476a1f05e8ac2be3941eb2803a5eee298f3b6e22000000035db7aab80f9752696e481521dcb00266a896c8e0d3cd183562925687805ff694000000084a5a8c24482b40e759b041b13c6c3ff2a12b33db6a445f14280074d097bc82cf334d083ffde0265db5a150c4ee57515af7992dde5d1216b1a02174033e9ab36	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{185DB3B6-0522-11EE-B7D7-6A765FEA1DF2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001d11ff1fb6604945898027f66c60145b000000000200000000001066000000010000200000009c8de455f8ada216c6413e946bd2149470d98a4a510f0a97caf21b063bddd943000000000e800000000200002000000083591c6c8413422b1ce3522efaecabc834cdbe432b7b3a266894aee27aaf740c2000000036f766e0e70402a70b60cd101987acd652771308c281353ad44ad2bf0abe1b78400000009a7be26e222020c894249c774b3669bd54b0f9db4fcccf52ec25d04985172e1eb42e211de5cad64ad701637cd4ace9d82e3ff2d4bdbef99a89eb108456068152	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3994404640"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406f31ef2e99d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f74def2e99d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31037742"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31037742"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3994404640"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4704 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4704 iexplore.exe
4704 iexplore.exe
1148 IEXPLORE.EXE
1148 IEXPLORE.EXE
1148 IEXPLORE.EXE
1148 IEXPLORE.EXE
4704 iexplore.exe

pid	process
4704	iexplore.exe

pid	process
4704	iexplore.exe
4704	iexplore.exe
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE
1148	IEXPLORE.EXE
4704	iexplore.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 4704 wrote to memory of 1148	4704	iexplore.exe	IEXPLORE.EXE
PID 4704 wrote to memory of 1148	4704	iexplore.exe	IEXPLORE.EXE
PID 4704 wrote to memory of 1148	4704	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://pub-14d6971b695f4478806b7fe0ddac5ece.r2.dev/loginofficeauthpage.html?email=ulfk@regering.se
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4704 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
Filesize
1KB

MD5
fdc4d6dd3cad9e995c8ebb840a670001

SHA1
3f5731796b9dd14fc77736a33cb94a8f27b4c9ef

SHA256
d68e2511c2edf3139639674eb694d076cd7614775026fda313ac3887b2673595

SHA512
bf3e726837619b9c6636846332b12169dc012a02600ab48cf5e925aac5db6143ede906847e8447e78bf6c7078cf6a38cb7e1c96b29c327ee71f4fa00a56bbd4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
9f40f0353257052e597cc6a63918ff40

SHA1
1c28ed248cce39532cec1a8685dbef608f1fcc1a

SHA256
71ac9b72aa96f07fc0108f5762830c2007eccf77726516bc4c31de6f619e04fd

SHA512
f9b9c9377b51d371d7e1691e46f5be78ec11745fafda0713844c6aba10c075afa8e07b9dae67794fe06a1f8d99258d016b7afd386d5a257c57e3bab3a1318713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
Filesize
416B

MD5
c69924de64896ced8beef61bca442732

SHA1
b6845e050144684d31fe23509616304b006a2062

SHA256
cf00aaf135e70899b51ffb63990c4ffa61094b01ce6a1e44777c0780d2f8d947

SHA512
abbdc0dee5abbac4c681ad9da68ec3938ac4fb6e89866aa1df5db9c148d471f278467cb7afc37ee63cde0ecd2632f80f8801fc136eda9c570077df0f787d8009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
95245e02bb02a16453493ee229eaf40f

SHA1
1ce2c61e77fb58f781c4ac89e907db996a48e18d

SHA256
988ff00cd7f6b0919f4ece5aa2df0f528196aae17e47374ea19f600750602cee

SHA512
5ed931d7ebd4b1b43fe544d818e07025d4da0b35e611d4022108c4649a80a67bfc6f2bff4c2d806cc41ced78765a769e614c9f212502b6ae85f1dc38fcfb93b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF9A7.tmp
Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9afmek3\imagestore.dat
Filesize
17KB

MD5
8cb9632d0b558ef80f32721e3a1c8802

SHA1
eea942f1fb4857b56be905e5c58b4c4be200d7a6

SHA256
7a324ab03df4f5c5d26bfcf21a922852f5f88f82082018d16ea54550fdde373b

SHA512
005b155b50710adeb7cd6ba89562bef49938fb224802ed68d9336c58a03b1d7f996da3edb144b90f364076a6228cb35c8344cc13286612a993c945a75d2ebab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9afmek3\imagestore.dat
Filesize
17KB

MD5
8cb9632d0b558ef80f32721e3a1c8802

SHA1
eea942f1fb4857b56be905e5c58b4c4be200d7a6

SHA256
7a324ab03df4f5c5d26bfcf21a922852f5f88f82082018d16ea54550fdde373b

SHA512
005b155b50710adeb7cd6ba89562bef49938fb224802ed68d9336c58a03b1d7f996da3edb144b90f364076a6228cb35c8344cc13286612a993c945a75d2ebab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\qsml[1].xml
Filesize
476B

MD5
ce12a9b263e3fbc18b7c0000ac06efc4

SHA1
fbbbc99b93020663a9433350d990ca7c9dfbac6a

SHA256
86bc91dbd8a6e21c2ac3cefe7bc8270ab51845db1265208c8b59501d5e2d81d7

SHA512
4e0896d9d5fd7c7bb81bde3dcbde82266dbe80cbf21b95d583becd1476e54e8d8833f73756d96d302c1d85e7fe41db7189dc258c836d50b854dfa0de1c6e755a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\favicon[1].ico
Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit