Overview
overview
9Static
static
3074a14a6cb...ca.exe
windows7-x64
9074a14a6cb...ca.exe
windows10-2004-x64
9Uninstall.exe
windows7-x64
3Uninstall.exe
windows10-2004-x64
3js/errorHandler.js
windows7-x64
3js/errorHandler.js
windows10-2004-x64
3js/localization.js
windows7-x64
3js/localization.js
windows10-2004-x64
3js/main.js
windows7-x64
3js/main.js
windows10-2004-x64
3js/metrika.js
windows7-x64
3js/metrika.js
windows10-2004-x64
3js/polyfills.js
windows7-x64
3js/polyfills.js
windows10-2004-x64
3js/statistics.js
windows7-x64
3js/statistics.js
windows10-2004-x64
3main.html
windows7-x64
1main.html
windows10-2004-x64
1run.hta
windows7-x64
8run.hta
windows10-2004-x64
8settings.hta
windows7-x64
8settings.hta
windows10-2004-x64
8settings.html
windows7-x64
1settings.html
windows10-2004-x64
1start.cmd
windows7-x64
1start.cmd
windows10-2004-x64
1Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
074a14a6cbe12ea8bd8e24d82c352ac14334a79238b5e7c3732da8d5b25753ca.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
074a14a6cbe12ea8bd8e24d82c352ac14334a79238b5e7c3732da8d5b25753ca.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
js/errorHandler.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
js/errorHandler.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
js/localization.js
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
js/localization.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
js/main.js
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
js/main.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
js/metrika.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
js/metrika.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
js/polyfills.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
js/polyfills.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
js/statistics.js
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
js/statistics.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
main.html
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
main.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
run.hta
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
run.hta
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
settings.hta
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
settings.hta
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
settings.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
settings.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
start.cmd
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
start.cmd
Resource
win10v2004-20240426-en
General
-
Target
run.hta
-
Size
1KB
-
MD5
7d2c494778be2b7a3a1d3b780b058ddd
-
SHA1
32009f732f3fee3a3c91326f3815df8f43375790
-
SHA256
006693ec698c4c3c7410fcbeba07c0cb7ab638f17e74786db0b6e72ba7d8b4b7
-
SHA512
b33f0cc32fd200d4f91d1af931c72ba388c0711b60df07f4fd94924d7d863199d4cbc60fcead95d94bcb6d2da77f05bc742262371305364966912bc4e64070b2
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 7 1620 mshta.exe 9 1620 mshta.exe 12 1620 mshta.exe 15 1620 mshta.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\run.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Blocklisted process makes network request
PID:1620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3148,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:81⤵PID:1632