Edit tour

Windows Analysis Report
na.hta

Overview

General Information

Sample name:	na.hta
Analysis ID:	1532432
MD5:	33425007f0016d3a818d27539ba17a90
SHA1:	2e864bd0246e10b0a99681303439a988999b2015
SHA256:	f4a208b490ce6094b8fa61c226db5f8f1eb01e95dc478b175a57a121a5f812e6
Tags:	CobaltStrikehtauser-abuse_ch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Generic Dropper

Sigma detected: Legitimate Application Dropped Executable

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 4500 cmdline: mshta.exe "C:\Users\user\Desktop\na.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.hta	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
na.hta	Msfpayloads_msf_6	Metasploit Payloads - file msf.vbs	Florian Roth	0x7680:$s1: = CreateObject("Wscript.Shell") 0x7464:$s2: = CreateObject("Scripting.FileSystemObject") 0x74f3:$s3: .GetSpecialFolder(2) 0x7616:$s4: .Write Chr(CLng(" 0x42:$s5: = "4d5a90000300000004000000ffff00 0x75df:$s6: For i = 1 to Len( 0x75fd:$s7: ) Step 2

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1698419140.00000000069BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000003.1708227795.00000000069BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000002.2937593299.00000000069BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000002.2935901869.000000000353E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000002.2935901869.000000000353E000.00000004.00000020.00020000.00000000.sdmp	Msfpayloads_msf_6	Metasploit Payloads - file msf.vbs	Florian Roth	0x7c0:$s1: = CreateObject("Wscript.Shell") 0x10974:$s1: = CreateObject("Wscript.Shell") 0x10758:$s2: = CreateObject("Scripting.FileSystemObject") 0x107e7:$s3: .GetSpecialFolder(2) 0x1090a:$s4: .Write Chr(CLng(" 0x119e:$s5: = "4d5a90000300000004000000ffff00 0x108d3:$s6: For i = 1 to Len( 0x108f1:$s7: ) Step 2
00000000.00000003.1707959124.00000000035B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000003.1698502405.00000000069BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000002.2936245668.00000000035B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000003.1707959124.0000000003597000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000002.2936220452.00000000035A5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000002.2935901869.000000000357C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
00000000.00000003.1708098991.00000000035B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
Process Memory Space: mshta.exe PID: 4500	JoeSecurity_GenericDropper_2	Yara detected Generic Dropper	Joe Security
Process Memory Space: mshta.exe PID: 4500	Msfpayloads_msf_6	Metasploit Payloads - file msf.vbs	Florian Roth	0x122b:$s1: = CreateObject("Wscript.Shell") 0x72a3:$s1: = CreateObject("Wscript.Shell") 0x8ee4:$s1: = CreateObject("Wscript.Shell") 0x9bb0:$s1: = CreateObject("Wscript.Shell") 0x1b6e4:$s1: = CreateObject("Wscript.Shell") 0x485d8:$s1: = CreateObject("Wscript.Shell") 0x582dd:$s1: = CreateObject("Wscript.Shell") 0x72089:$s1: = CreateObject("Wscript.Shell") 0x8ab02:$s1: = CreateObject("Wscript.Shell") 0x100f:$s2: = CreateObject("Scripting.FileSystemObject") 0x7087:$s2: = CreateObject("Scripting.FileSystemObject") 0x8cc8:$s2: = CreateObject("Scripting.FileSystemObject") 0x19531:$s2: = CreateObject("Scripting.FileSystemObject") 0x580c1:$s2: = CreateObject("Scripting.FileSystemObject") 0x71e6d:$s2: = CreateObject("Scripting.FileSystemObject") 0x109e:$s3: .GetSpecialFolder(2) 0x7116:$s3: .GetSpecialFolder(2) 0x8d57:$s3: .GetSpecialFolder(2) 0x1958b:$s3: .GetSpecialFolder(2) 0x58150:$s3: .GetSpecialFolder(2) 0x71efc:$s3: .GetSpecialFolder(2)
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Legitimate Application Dropped Executable

Source: File created

Author: frack113, Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\mshta.exe, ProcessId: 4500, TargetFilename: C:\Users\user\AppData\Local\Temp\rad5F45E.tmp\Session.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.hta

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.hta	Virustotal: Detection: 62%			Perma Link
Source: na.hta	ReversingLabs: Detection: 65%

System Summary

Malicious sample detected (through community Yara rule)

Source: na.hta, type: SAMPLE	Matched rule: Metasploit Payloads - file msf.vbs Author: Florian Roth
Source: 00000000.00000002.2935901869.000000000353E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.vbs Author: Florian Roth
Source: Process Memory Space: mshta.exe PID: 4500, type: MEMORYSTR	Matched rule: Metasploit Payloads - file msf.vbs Author: Florian Roth

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\rad5F45E.tmp\Session.exe CF270EDC59DAFA6D10C184E07BE53D4C27C9918BDCBFDBB84DFE0E68D1DBB082