38cdfb86d0025937d70600824376db22f970a3271de2a23cb636f14b0f63c222

General

Target

copia_do_documento.exe
Size

140KB
MD5

da23a82c2b7f0e3be078dac023e36914
SHA1

836feba24264859fd7a7a73964386342f7757a36
SHA256

4fc6e89128e13ba773311448e69a718b278172810537caee89fe415457f73142
SHA512

1484f659e12be82d4ecc7f27c6edf364e935c0acc0a86245d1f8fc47d33ea8ec6df3ab7e2b922672f68b62a5a5b7edbcfbde8b34f61ca537858b2a81549534e9
SSDEEP

3072:KqhVNmE0yFVOaeDF9eoyfp7zoH8wf4iBHeS:KqrNJ8ooyF48wf4iBHe

Score

10^/10

adware evasion stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	28112022.exe

Executes dropped EXE 1 IoCs

pid	Process
900	28112022.exe

Loads dropped DLL 2 IoCs

pid	Process
1200	copia_do_documento.exe
1200	copia_do_documento.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	28112022.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	28112022.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	28112022.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\NoExplorer = "1"	28112022.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376440796"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0987DFD1-6F6F-11ED-9FD0-D6EA6736E294} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
988	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1200	copia_do_documento.exe
900	28112022.exe
988	iexplore.exe
988	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 900	1200	copia_do_documento.exe	27
PID 1200 wrote to memory of 900	1200	copia_do_documento.exe	27
PID 1200 wrote to memory of 900	1200	copia_do_documento.exe	27
PID 1200 wrote to memory of 900	1200	copia_do_documento.exe	27
PID 900 wrote to memory of 1784	900	28112022.exe	29
PID 900 wrote to memory of 1784	900	28112022.exe	29
PID 900 wrote to memory of 1784	900	28112022.exe	29
PID 900 wrote to memory of 1784	900	28112022.exe	29
PID 900 wrote to memory of 1784	900	28112022.exe	29
PID 900 wrote to memory of 1784	900	28112022.exe	29
PID 900 wrote to memory of 1784	900	28112022.exe	29
PID 900 wrote to memory of 2028	900	28112022.exe	30
PID 900 wrote to memory of 2028	900	28112022.exe	30
PID 900 wrote to memory of 2028	900	28112022.exe	30
PID 900 wrote to memory of 2028	900	28112022.exe	30
PID 900 wrote to memory of 2028	900	28112022.exe	30
PID 900 wrote to memory of 2028	900	28112022.exe	30
PID 900 wrote to memory of 2028	900	28112022.exe	30
PID 900 wrote to memory of 988	900	28112022.exe	32
PID 900 wrote to memory of 988	900	28112022.exe	32
PID 900 wrote to memory of 988	900	28112022.exe	32
PID 900 wrote to memory of 988	900	28112022.exe	32
PID 988 wrote to memory of 1528	988	iexplore.exe	33
PID 988 wrote to memory of 1528	988	iexplore.exe	33
PID 988 wrote to memory of 1528	988	iexplore.exe	33
PID 988 wrote to memory of 1528	988	iexplore.exe	33

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ = "1"	28112022.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	28112022.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	28112022.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	28112022.exe

C:\Users\Admin\AppData\Local\Temp\copia_do_documento.exe
"C:\Users\Admin\AppData\Local\Temp\copia_do_documento.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\28112022.exe
  "C:\Users\Admin\28112022.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Installs/modifies Browser Helper Object
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:900
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s c:\Users\Admin\mrouhlns\mrouhlns.dll
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s c:\Users\Admin\mrouhlns\mrouhlns.dll
    3⤵
    PID:2028
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\28112022.exe

Filesize
140KB

MD5
da23a82c2b7f0e3be078dac023e36914

SHA1
836feba24264859fd7a7a73964386342f7757a36

SHA256
4fc6e89128e13ba773311448e69a718b278172810537caee89fe415457f73142

SHA512
1484f659e12be82d4ecc7f27c6edf364e935c0acc0a86245d1f8fc47d33ea8ec6df3ab7e2b922672f68b62a5a5b7edbcfbde8b34f61ca537858b2a81549534e9

Download Submit
C:\Users\Admin\28112022.exe

Filesize
140KB

MD5
da23a82c2b7f0e3be078dac023e36914

SHA1
836feba24264859fd7a7a73964386342f7757a36

SHA256
4fc6e89128e13ba773311448e69a718b278172810537caee89fe415457f73142

SHA512
1484f659e12be82d4ecc7f27c6edf364e935c0acc0a86245d1f8fc47d33ea8ec6df3ab7e2b922672f68b62a5a5b7edbcfbde8b34f61ca537858b2a81549534e9

Download Submit
C:\Users\Admin\28112022.tmp

Filesize
60B

MD5
9f288d9e8cc3e677598b3f8ec45e5a5c

SHA1
efc1f0f5a05e2ffd6b516f8a0ceb4cd5f8c005a0

SHA256
815bfdb2782c81f536cfd6b77f550d3b7dd087dab0e00c5101307c96dca60f18

SHA512
1c68c6a88ee687e2882153f6706fc875529778d98596a33f7eac078bb265ffa2c1c342e2c5a94df1335aa52f63405f5b608cec066bfaa96d0e33b047456868eb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7B5QGMX7.txt

Filesize
608B

MD5
fb608432c36dde91f588d341c1d62d5f

SHA1
91bf5c4ee7fa817280f1128e34255b8a5f6dfe8b

SHA256
3763c2b8fc9fe1d73549163a1effdff8186a27dd3f53f7e5e98060bde828001c

SHA512
ec8b5c559f1cc7490c1e817c5d685a691aea663246d661d8ab853ae28df0ad53ec366e958417b67d895f6d58e1d9f8fae388bfbdc71aa0f19ec0b091913207a6

Download Submit
\Users\Admin\28112022.exe

Filesize
140KB

MD5
da23a82c2b7f0e3be078dac023e36914

SHA1
836feba24264859fd7a7a73964386342f7757a36

SHA256
4fc6e89128e13ba773311448e69a718b278172810537caee89fe415457f73142

SHA512
1484f659e12be82d4ecc7f27c6edf364e935c0acc0a86245d1f8fc47d33ea8ec6df3ab7e2b922672f68b62a5a5b7edbcfbde8b34f61ca537858b2a81549534e9

Download Submit
\Users\Admin\28112022.exe

Filesize
140KB

MD5
da23a82c2b7f0e3be078dac023e36914

SHA1
836feba24264859fd7a7a73964386342f7757a36

SHA256
4fc6e89128e13ba773311448e69a718b278172810537caee89fe415457f73142

SHA512
1484f659e12be82d4ecc7f27c6edf364e935c0acc0a86245d1f8fc47d33ea8ec6df3ab7e2b922672f68b62a5a5b7edbcfbde8b34f61ca537858b2a81549534e9

Download Submit
memory/1200-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads