92a8cc4e385f170db300de8d423686eeeec72a32475a9356d967bee9e3453138

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 09:42

Target

fix-error.hta
Size

74KB
MD5

acfba6ff2e80e0ebc80df9e7d326337c
SHA1

fe28d5756815fdac31a744a2f11c075f5b1892bc
SHA256

92a8cc4e385f170db300de8d423686eeeec72a32475a9356d967bee9e3453138
SHA512

2dcea669b4b3135bca6eba88542948188e25fb040db0a83bac03957b1fd59037998e7bb4a38774115ca051f07cbeacf99fd95113321e6c8fae4568a2e4e30f00
SSDEEP

768:BfaGWSO85ALmEcHUfkJ7Bate4LV1VZ6Y3PaNNHpXKMcpgUj:gGZALNcH77BajLbf61NR1pcbj

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

mshta.exe

flow pid process

4 3676 mshta.exe
6 3676 mshta.exe
12 3676 mshta.exe
17 3676 mshta.exe
20 3676 mshta.exe
Detected potential entity reuse from brand GOOGLE.
phishing google
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

mshta.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact