2a33b7926e8bcf707f1c32fd49a339862fc46b18bf02b370d0a3420fd5091db5

Analysis

max time kernel
94s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 14:25

Target

recaptcha-verify.hta
Size

2KB
MD5

500479d13faca2adba6ce4a330d8efa6
SHA1

82d1e8ae8d2065b210927a45833947a5ce2695a4
SHA256

2a33b7926e8bcf707f1c32fd49a339862fc46b18bf02b370d0a3420fd5091db5
SHA512

119d552a9adbfb66beeb6158755cf396a369a2df6c99d29a229c670f0e3a0b05477a580a09561446cca7ffa1a31da3e550e99ae673e3f35a943e973fa1410207

Score

8^/10

Blocklisted process makes network request 8 IoCs

Processes:

mshta.exe

flow pid process

6 4992 mshta.exe
7 4992 mshta.exe
9 4992 mshta.exe
10 4992 mshta.exe
12 4992 mshta.exe
14 4992 mshta.exe
16 4992 mshta.exe
17 4992 mshta.exe
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand GOOGLE.
phishing google
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

mshta.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact