f7eff33c3e2043ab75c1e2f6a37bb1adf9f32635347493fa5780f1f5020aea05

General

Target
Comprovativo_Junho_22-06-2026-gLQcpfR.vbs
Size 6.8MB
Sample260622-pe5pbab16w
SHA256 f7eff33c3e2043ab75c1e2f6a37bb1adf9f32635347493fa5780f1f5020aea05
MD5 9964641548c37355defdac4bdd3b4585
SHA1 bd1dbd745ce88d8d1b065bf720f3d11a9ce75fb1
SHA512 52f24e58b5f5ff418aa9db015092e7f914b2093cd69877d408a998444d0c8cbe229412c83349708aeaf3e7226ff25b259d5c3623a02af0c99bebfcefc9be374a
SSDEEP 12288:dNAQFtlqDL5a4d+TKeaay4gXtZVBBKtR2FSJPSMI0AkQaK+M+GqfGMd:/A6t0VVHAt6MI2PGMd
TLSH
T1736697F095284DE9D3EBC458F9A6D0C3AE45542B0BB591E73AF20A6D3C6207043E69FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery persistence spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc00000000020000000000106600000001000020000000c88a9ee0501c7143d3f1fe748d740c741349ab271c07c21689b963375cfbc10f000000000e8000000002000020000000dfea01dcc59725a42fa80e5997deba7ff8335460ebae2f9280bfd77e58e416d22000000067d3c2b3ba423d158f4a8f0937b409e110f682dce500f2edba304fa8bf8ab20f4000000031cc2a70509e4660ce9012e115e71e13ff7e65860dd109893ca72dde228d8fe8cacb5468d5a38b47c3bd1e279dda3b323d98bb935494d1229b647c2869df237b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606594804902dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1629c33be3ac94191105fdf3de697dc00000000020000000000106600000001000020000000af0fdac87649d0007b98f9a7994c3bbb674576bcdaae11444ee70f85d378c35b000000000e80000000020000200000005079f9c66a0db992bd4edff624f067570b56308ca98a17b195376d4a40fdb318200000009aae1330320d5f45f82b0e07dea17cb7a6771c4b91ada547bdf0fe8cf57a0d02400000007c98ba2152218dab1c5092b30e41a3c332e4b3462da6ea00a72005a908230e956209a549b248c802daeac01258bd89761ec3cd7c2acca816df235e681f79d9dd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4943A8EB-6E34-11F1-9D43-761C4632812C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31261249"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "502578100"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2628	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2628	iexplore.exe
2628	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2480	2628	iexplore.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Comprovativo_Junho_22-06-2026-gLQcpfR.vbs"
1⤵
PID:3168

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2384

C:\Windows\system32\cmd.exe
cmd.exe cmd /c copy /Y "C:\Users\Admin\AppData\Local\Temp\Comprovativo_Junho_22-06-2026-gLQcpfR.vbs" "C:\Users\Admin\AppData\Local\Temp\135.vbs" & move /Y "C:\Users\Admin\AppData\Local\Temp\135.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\135.vbs"
1⤵
PID:2456

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2392

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\6570.vbs"
1⤵
PID:3520

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1876

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6570.vbs

Path C:\Users\Admin\AppData\Local\Temp\6570.vbs
Size 71KB
SHA256 f1562d74ffe9e40b548ad3670d4b94f9cc8adaf8f0c59d60c876c0bb3a6f98cd
MD5 883c02c44475e1fb547dd85eb5cbe461
SHA1 325550b9569e1656df2fc4d7bb91e4dab6bf11dd
SHA512 7e4d5fa28ff7a84096657a0805f042a4c19bf141f6ba36f8dccadb941f8004e2092e3ef147886b8630eef4c7e827ab2632fda604bad43b808b2dabd7886690fe
SSDEEP 1536:lkiq7MPaE0Pd0V3HlsYT3kAK30+hAxXdlvkX7kJxtKb/J9iA:l07ued0V3Hl/T3oEHxXdCQpKl9V
TLSH
T1C463AE46C31A960BA3C73372BC454212B5CD59D9022C02C7B9DED93E6B7DB5A83D8B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing