f5e6f446d16656f177de32fce2ff5ea94436c3600451ab84ef9342a9be45687c

General

Target

Anexo - 884910003984.dll
Size

1004KB
MD5

c76d0f70d6bca4d82ffd570530d7d6b4
SHA1

74e70da6952c6c0fede84114d5a1fe483811b633
SHA256

95b4e1cd0e79fe99235aed4be1746b7685b1de71b28f0f23794527909c0f22eb
SHA512

4b974cc165437479e32b56ffd1159783dd701a1b2395c1181b28770241e3b435955a7341f29ea284cd8e3a45a4d1220828ac5a884d2b7e3ae4a084034f171fd7
SSDEEP

24576:SRZvpR6IGilzTRdOy5xeEFuTMwvx1vCQrCje:ObL0rTMwvfvCQ2q

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1560 set thread context of 604 1560 rundll32.exe svchost.exe

description	pid	process	target process
PID 1560 set thread context of 604	1560	rundll32.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376084353"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aff770e870e12a478fd24646c18cd36b00000000020000000000106600000001000020000000ef86d9c010302c60cbea28e83f339a90a86aa8f1faaf2aadc3207faa26b033b9000000000e800000000200002000000086432d5e66a84d392b9ed53779f5876570b2ba597ab4db2a45ab6f53f42c47f720000000dc1b9e79422db2ece912ae3fb3c777ec09064e66eb8c12afbcf7cae08099a26240000000ce10036a7403d5dfc15b8b65dc3dc1830972cbed1c9312244b04c4548fb899cd1fd3f535f83870e119f47ef8aaf748e42a376e360d83eb001354529cde16438d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{184B6910-6C31-11ED-A755-C22E595EE768} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0058e9093e00d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aff770e870e12a478fd24646c18cd36b00000000020000000000106600000001000020000000bc468724ae036cc095d764a8a5683dd6851feabf6dd05617ed3e7641b1a84f2f000000000e800000000200002000000058111dacd534c915cdfd451c01e410982c40d019654ffe8fb1acdbacb9e4375f90000000679c67add63744dd033a3bd95e871e8d2328dfd0c306714ba5a2075890cac8cd5c37b074747c99a55ccd55913aabfaf54337b6e6254f9a8b57e5051589cb1055c7680b750d81a687f0ac5b024e6c45b0004aadfb7d1e86f00ecb70d6cd1e89d5c6674a28f3eb5f21fd2b8e63015e6097f022b11661b1eb704097ca3003afed54376e360f32b55ae6bbfe8c96b3f988b9400000003a00f8f56759f668159c69ec56870d231e244c360def48ef5ee810cb0b42cf39df5cdc8afb412fae149e88f76588c39abcbf0862b71599268e97a5ef21bc5c6a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

780 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

780 iexplore.exe
780 iexplore.exe
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE

pid	process
780	iexplore.exe

pid	process
780	iexplore.exe
780	iexplore.exe
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

rundll32.exerundll32.exesvchost.exeiexplore.exe

description	pid	process	target process
PID 1344 wrote to memory of 1560	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1560	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1560	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1560	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1560	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1560	1344	rundll32.exe	rundll32.exe
PID 1344 wrote to memory of 1560	1344	rundll32.exe	rundll32.exe
PID 1560 wrote to memory of 604	1560	rundll32.exe	svchost.exe
PID 1560 wrote to memory of 604	1560	rundll32.exe	svchost.exe
PID 1560 wrote to memory of 604	1560	rundll32.exe	svchost.exe
PID 1560 wrote to memory of 604	1560	rundll32.exe	svchost.exe
PID 1560 wrote to memory of 604	1560	rundll32.exe	svchost.exe
PID 1560 wrote to memory of 604	1560	rundll32.exe	svchost.exe
PID 604 wrote to memory of 780	604	svchost.exe	iexplore.exe
PID 604 wrote to memory of 780	604	svchost.exe	iexplore.exe
PID 604 wrote to memory of 780	604	svchost.exe	iexplore.exe
PID 604 wrote to memory of 780	604	svchost.exe	iexplore.exe
PID 780 wrote to memory of 1684	780	iexplore.exe	IEXPLORE.EXE
PID 780 wrote to memory of 1684	780	iexplore.exe	IEXPLORE.EXE
PID 780 wrote to memory of 1684	780	iexplore.exe	IEXPLORE.EXE
PID 780 wrote to memory of 1684	780	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anexo - 884910003984.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Anexo - 884910003984.dll",#1
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:604

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.java.com/pt_BR/
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5efd36e97df5e2cee98586705d6d7603

SHA1
05f746c875b2d23c976ad7d33aa01de342a029f4

SHA256
50b481254b481b96631baad459299b40a097d0bac6b3bc32b185b7fc5fd75a5c

SHA512
2167e7cfd4e49b4df93780915bc53a6450fa4b192d6c43e94198d11e1065f0a08b535497010ef10f9ac83a050446f2f6977150bb95630ae632ab22884dd564ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\image.gif

Filesize
1KB

MD5
98d402a74b4d9377b565e8a5ee954cba

SHA1
f2b794ab97738fe4bbbf426bb9162af9e6e18091

SHA256
e28d4e6788e15b9591c58e897d485b4caa27905e3abbad80ae26ee75e1fc6baa

SHA512
a172010136eaa953a0b58a742fd2f9c48a621b85f4eeddf7114317ece84f6d434dd3fa11f55c91c9376dc0967d71e1f00b4f25957fd9a2a1b1cb96528449853d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2PC3XCS0.txt

Filesize
601B

MD5
7ede3d974f9bbc0f402128208d55fc0a

SHA1
4c21f03c9262848f7dd974709b634435a1f92ffe

SHA256
55a654f45bcfe3cd4f054a6619def1ebf1b3601979607ad75d2dcd544e066c43

SHA512
c103ed1270e60a0bbd77d7fec45ea70eb153b1b964c92fa599799910121407d92dd42df6ea8aefc35d516f748cdfa2881f5e6007472eb621a7a09b3678758ffe

Download Submit
memory/604-61-0x000000003C040000-0x000000003C09F000-memory.dmp

Filesize
380KB

Download
memory/604-60-0x000000003C082744-mapping.dmp

Download
memory/604-63-0x000000003C040000-0x000000003C09F000-memory.dmp

Filesize
380KB

Download
memory/604-59-0x000000003C040000-0x000000003C09F000-memory.dmp

Filesize
380KB

Download
memory/604-65-0x000000003C040000-0x000000003C09F000-memory.dmp

Filesize
380KB

Download
memory/604-66-0x000000003C040000-0x000000003C09F000-memory.dmp

Filesize
380KB

Download
memory/604-67-0x000000003C040000-0x000000003C09F000-memory.dmp

Filesize
380KB

Download
memory/604-57-0x000000003C040000-0x000000003C09F000-memory.dmp

Filesize
380KB

Download
memory/1560-54-0x0000000000000000-mapping.dmp

Download
memory/1560-56-0x0000000000820000-0x0000000000925000-memory.dmp

Filesize
1.0MB

Download
memory/1560-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing