0356d7f65407b958a06441d53a33e7424b51c3d82d539b14fbd7e6acadec1f1c | Triage

Analysis

max time kernel
1793s
max time network
1793s
platform
windows7_x64
resource
win7v20201028
submitted
20-11-2020 18:09

Sharing

Report Analysis Logs

General

Target

Query_Ref_CSQ5329906_pdf.hta
Size

1.3MB
MD5

553b0bae700b8e1f563fc338ad3246e1
SHA1

8b77b7643e43aa66a92508f14331648ddf29610c
SHA256

0356d7f65407b958a06441d53a33e7424b51c3d82d539b14fbd7e6acadec1f1c
SHA512

1ef2473e4522877a9be28ede38dd32e52ef2a6e6dae7a60b875ab87d13b78989c8c4f8b85d727b5649dff3667362782773e2c82d1f8d28799893be6be8fb37f9

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 170 IoCs

Processes:

mshta.exe

flow	pid	process
6	2028	mshta.exe
9	2028	mshta.exe
12	2028	mshta.exe
15	2028	mshta.exe
18	2028	mshta.exe
21	2028	mshta.exe
24	2028	mshta.exe
27	2028	mshta.exe
30	2028	mshta.exe
33	2028	mshta.exe
36	2028	mshta.exe
39	2028	mshta.exe
42	2028	mshta.exe
45	2028	mshta.exe
48	2028	mshta.exe
51	2028	mshta.exe
54	2028	mshta.exe
57	2028	mshta.exe
60	2028	mshta.exe
63	2028	mshta.exe
66	2028	mshta.exe
69	2028	mshta.exe
72	2028	mshta.exe
75	2028	mshta.exe
78	2028	mshta.exe
81	2028	mshta.exe
84	2028	mshta.exe
87	2028	mshta.exe
90	2028	mshta.exe
93	2028	mshta.exe
96	2028	mshta.exe
99	2028	mshta.exe
102	2028	mshta.exe
105	2028	mshta.exe
108	2028	mshta.exe
111	2028	mshta.exe
114	2028	mshta.exe
117	2028	mshta.exe
120	2028	mshta.exe
123	2028	mshta.exe
126	2028	mshta.exe
129	2028	mshta.exe
132	2028	mshta.exe
135	2028	mshta.exe
138	2028	mshta.exe
141	2028	mshta.exe
144	2028	mshta.exe
147	2028	mshta.exe
150	2028	mshta.exe
153	2028	mshta.exe
156	2028	mshta.exe
159	2028	mshta.exe
162	2028	mshta.exe
165	2028	mshta.exe
168	2028	mshta.exe
171	2028	mshta.exe
174	2028	mshta.exe
177	2028	mshta.exe
180	2028	mshta.exe
183	2028	mshta.exe
186	2028	mshta.exe
189	2028	mshta.exe
192	2028	mshta.exe
195	2028	mshta.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Query_Ref_CSQ5329906_pdf.hta"
1⤵
- Blacklisted process makes network request
- Modifies Internet Explorer settings
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmp

Filesize
2.5MB

Download