hxxps://goodyear[.]petchseeg[.]com/?e=bmlra2lfdmVybWVsaXNAZ29vZHllYXIuY29t

General

Target

https://goodyear.petchseeg.com/?e=bmlra2lfdmVybWVsaXNAZ29vZHllYXIuY29t

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7660D951-13CF-11ED-9DDD-6EB64412F54B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba54270000000002000000000010660000000100002000000097c3fddd8243b4b6be46e0258a7b489b4280b8d6a9b462207c57b35c0b56feca000000000e80000000020000200000003a60d6fd90eeb2d7937cd474fd6f13749da0d1425050e9cdc9de5b083945a79890000000b452a023a03406863cf2d6a883e3e82c2a5d457759e3157a9922486cad830e022bf42e493fcf70cf18dac26b1d7b9acc230578e2ae176de70061c9e9b1b872bdd732e007ebf0fb67a862fc3449c7ca4dc1f3b84081ab11c2d36b3fb95f500d65e1a588df2e994684d64073b5dd0cf34c6bad8257867b0be1573573d5c500b37dd0f8416523e5bf06a0bc7cc5305891b1400000006b484849a56319ee70624da517c53371f46aff002bfe6302c07715a4c3167dda2c6a09f88d20fe14a4d7524542f8ba431ed8e26d1c5f53e46f3033ec3b8a78c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366366706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba542700000000020000000000106600000001000020000000cdfbbe315a2f490112d494401733c5926471cf976ad274868b9d68ef634c953b000000000e800000000200002000000071286e419b62e85bf8c813b80f2f747b2b88b192a420159ae60ba9eb53abf8a020000000c904cf990d054a129a98d5c60b08de81174ed07844c3d1fe175ca4ba5a2264224000000041c2af41c8fd48e5b75e2cd81fdca6be2d12dbf4e58589c7651f705989741723769b148197c6a0ea33caa72d92bb5babdffc07e9eae71810bba2e1700ad40fb6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30cf9e53dca7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1096 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1096 iexplore.exe
1096 iexplore.exe
1668 IEXPLORE.EXE
1668 IEXPLORE.EXE
1668 IEXPLORE.EXE
1668 IEXPLORE.EXE
1096 iexplore.exe

pid	process
1096	iexplore.exe

pid	process
1096	iexplore.exe
1096	iexplore.exe
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1668	IEXPLORE.EXE
1096	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1096 wrote to memory of 1668	1096	iexplore.exe	IEXPLORE.EXE
PID 1096 wrote to memory of 1668	1096	iexplore.exe	IEXPLORE.EXE
PID 1096 wrote to memory of 1668	1096	iexplore.exe	IEXPLORE.EXE
PID 1096 wrote to memory of 1668	1096	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://goodyear.petchseeg.com/?e=bmlra2lfdmVybWVsaXNAZ29vZHllYXIuY29t
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize
1KB

MD5
1373d0c10451574ecc57c83379ea3fd6

SHA1
537badffa83c7cb5d1eef45158d89c2c363c04cb

SHA256
e79f535977c6131ae3fdf952422c3b3f777c456d002486170bba7d5bb190d75b

SHA512
f798880e5dfd6625c78ad21c6f25e7e0a51552bd3cb64d0baba050a65eebc7651e1ef04748d5edc25da2ba23bc72a436ddda277b65091c85b16208f2b4c069e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
Filesize
434B

MD5
e740593e2b2c9c5c4b61e79c812b1f1a

SHA1
242808da1b21cd957baa529e2fe26b35f1d1e878

SHA256
86747ca3235c1bbb177b1808d1a8a21987d6e9909e98609ee88bbb99ea8af625

SHA512
28c4d5f6ef6465598e0d98bddfdc4069c4f558637d62bbe53b2ea3136ea12d4197ac17c94439a563add09c8bdd5b31c5a2e4832d2a85009606ea8409efe33235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
0c920d463bb3492be553b904b4233b6f

SHA1
dda19ce8ea3f5b5a91bed1dd6990a870847246e5

SHA256
c8055cf2e406da583363f937098a561a18c51b19fe20a316290917e6e09f07f0

SHA512
dc090f1a4f08b2eb58f454e09bf2f3aadaa5ef08a1db1981b32c5883f69484e1378c1162a2ee0c3376ff1d0d9bbd847d41c5befdb4e611abf6157145f3f8ab61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\3uhj3kn\imagestore.dat
Filesize
8KB

MD5
7da3ac6a122f6092daae1ae442f4637a

SHA1
0669aabbe8152d0fc5b0404795da9dbd46f5fc7e

SHA256
9d9867813978c63cbc051ccf4fbe0bafc2ada86c9a2813485aaca82ee2fe0b0e

SHA512
8ade336ed903fb6fbc8ba66ecbebe6224601155b779052715b35429b4fa94c553c97e32ff12fd5914c7937ff23186454a8e552a00f3b85d352eafa022ff641f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\3uhj3kn\imagestore.dat
Filesize
14KB

MD5
90fac459b713f20f28b802de88255679

SHA1
9b9f65a178c1f9fe80c82e6481f97f7a337bb75e

SHA256
da36b68a46a611d32b34df9b5cb1bef680f3b4cfa896cb7c34e474bce74f4b8e

SHA512
54c414322c3a71f5e49d7a9d9ed7fb858c5b3f81457c263134af0ece9c5bfaf8dcb9d96eecaa19d91dd03b6d282a74b51e832cb0ff7580713d4cbaf51e49aba5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0VKQL0VD.txt
Filesize
606B

MD5
cf3c9b16d754f1fdc2a0c08481bbb0d0

SHA1
5806c47992bf119c420ea007ae16f20c56265d86

SHA256
f1a7ba41404cadad4cb5154e7a7b0762294ec2490ffbba46edacdacc128525a2

SHA512
ade3fd0af5495866bf52115f15c0bb2ac0e15ec9043ffd746f3fc20c8dd903c17665131af002968e284b1fa44c0c561edac497abeb589b4b205819fdad065b20

Download Submit

Analysis

Sharing