Analysis
- max time kernel
300s - max time network
213s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
08/11/2025, 13:18
General
- Target t1.hta
- Size 75KB
- Sample251108-qj2znabx8a
- SHA256 58e6ae41d0a146d12edeb12bab9c702a19c09b3ccbdc8f93d2a209977d3cb917
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\t1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Badlisted process makes network request
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 14282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2904 -ip 29041⤵
-
C:\Windows\system32\mshta.exemshta.exe1⤵