hxxps://www[.]cdscom[.]co[.]th/index[.]php?option=com_easyblog&view=tags&layout=tag&id=3

General

Target

https://www.cdscom.co.th/index.php?option=com_easyblog&view=tags&layout=tag&id=3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366539975"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0db2fc26fa9d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\cdscom.co.th	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DOMStorage\cdscom.co.th\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a784628514125000000000200000000001066000000010000200000009beab690f9b676a4337eb5e0c4f7cb159be272b7cf6647fbb1e065eb35395eb4000000000e80000000020000200000004e41e44118cfdcd6f902332beb0c9fba413575a9ad45847b2e6690f7b7bd3d0520000000aa4d67d2dfee5728d9a073751a6dcc7211a9ccaef829588a3402deb31e2c7ea640000000719b70641cb2d9ab35b6bbe1425b1fbe8a7be0661b64152f8de7fcfcf1e8546a632c6c818e99e3f8749c0b6ebc8b46f51be727e541dc2a99fcb27cadae0c6156	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4285461-1562-11ED-B5DB-729619C04A4B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a78462851412500000000020000000000106600000001000020000000af2b83b980fec8fc62918c4718cfc92d227ddb6a91fb882f5c3535f403f281a6000000000e80000000020000200000006e53c04034f001b4d08dfd4d30e7c5f978b227f6749d5746cf5d7a816a9899789000000033eed19d721bce5dd18bc07f7526460ceb2a45bbb46bbf692617ea514356dda4baaee44bd493e36382ee60fc1bc4f5826f159bfeaa275b803cd4f6e7dd40fedf489eeedf6d039296651d3944489f5a6f15bf3ad48818b2180dd8222a782ee49c0ac76937a3780c902442504b7765a8d04fa9500782bb49da17f0732a76d5c4eeb610abac2d800793364a9748682aa9de400000009516fd183da5afecb3bbc3dcbd2dbaa1b2473c2d220354b79b2bb3a78e5044f7569cbdd5d314b89110b1c89d4cbaeb19aa5de4a88f0ad0fed94a499bf25e990a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

972 iexplore.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	process
972	iexplore.exe
972	iexplore.exe
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 972 wrote to memory of 996	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 996	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 996	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 996	972	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.cdscom.co.th/index.php?option=com_easyblog&view=tags&layout=tag&id=3
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
bd33b7ed00f6c9ed734ec98816df5b40

SHA1
2aaa5fcf86c5bd2a8194028be89be89a352c456f

SHA256
f03db7addfb5b17c1d056c51b5b1e56f1151d67edfdc1a4d11b8aa2e40d461a1

SHA512
795c6281b0811f0f851112e5473c56fcf44d3b13ee50b71c7e7c2c738c8913a96b798051e3d1c3cf0cc499f507c0f83ebc52e1f23cc3fb0749c077848dff74db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\78o90ak\imagestore.dat
Filesize
5KB

MD5
4fae29cdf010e221a2e739eb98688ecd

SHA1
64317246ef4dc246136669f68db4a3bcb3a94ae4

SHA256
12e66e0464e7b20c436a04bd26414f6cc3890ce912a5f0068bb709dfc7e6355b

SHA512
0358c742d58664c73388b62a9738040a8e6bc24951f0532ae400d200d4affc2ab4b36d3487367943ed4dc9603f200400ca2a19127cff04fd6d0bb8498f745a65

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KTSVSDO8.txt
Filesize
607B

MD5
68014ed59af17ee7073d745a144b8547

SHA1
8df3e4a2deb224130bffb6c68af8282b75032362

SHA256
43f3fc3ca7ae2e6ec5835335879e9b946e8885e5c49554a77910f1111c23c4c7

SHA512
ab172fc859d56f6c9bc3f63f041aa69811fbcad13565b09b27b87079007ae495856aadb8995b8a7476248093969179baec9e693ca70733a2c8ae14de412698b0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads