Edit tour
Windows
Analysis Report
default.hta
Overview
General Information
| Sample name: | default.hta |
| Analysis ID: | 1676286 |
| MD5: | 3dbd4bfc0e65d7ad83d90a9b45f65e49 |
| SHA1: | 7ce5d14340c68ff26e602ed903765f6ce5cc75b3 |
| SHA256: | 7f442e5bbc06204cec861f2bfde13bec0ba0cbdf3becb54caa421e03f09a1426 |
| Tags: | htauser-abuse_ch |
| Infos: | |
 | |
Detection
| Score: | 23 |
| Range: | 0 - 100 |
| Confidence: | 60% |
Signatures
Opens network shares
AV process strings found (often used to terminate AV products)
Detected TCP or UDP traffic on non-standard ports
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
One or more processes crash
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
mshta.exe (PID: 6240 cmdline: mshta.exe "C:\Users\ user\Deskt op\default .hta" MD5: 06B02D5C097C7DB1F109749C45F3F505) 
WerFault.exe (PID: 7360 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 240 -s 279 2 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
- • Compliance
- • Networking
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • Lowering of HIPS / PFW / Operating System Security Settings
- • Stealing of Sensitive Information
Click to jump to signature section
Show All Signature Results
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||