analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

t.hta

Full analysis: https://app.any.run/tasks/90bee9f8-daf6-45d2-8c2a-743ede754364
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: October 20, 2020, 11:10:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: text/html
File info: HTML document, ASCII text
MD5:

1D5EDEC083B3104946AA085C40D0755E

SHA1:

BF9F2FCE56D83D5A1C21C3863FCE703C85EC0443

SHA256:

0D460D22AB51D0D8C9F077DAAF08658981D723B612CF8D03B93DF5AEAF8EED21

SSDEEP:

12:wT/ns8vDTMe+jvWx40H4dgsJSccTVDpF/hNHH2WRH1W1BfFpXsCcadi8nfL:aLvfoWxwdJ98pF/hNHWuV4n89UVL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Internet Cache Settings

      • mshta.exe (PID: 2800)
    • Executable content was dropped or overwritten

      • mshta.exe (PID: 2800)
  • INFO

    • Reads internet explorer settings

      • mshta.exe (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
2800"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\t.hta"C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
430
Read events
421
Write events
9
Delete events
0

Modification events

(PID) Process:(2800) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2800) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2800) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2800) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2800) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2800) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2800) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2800mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\1[1].exeexecutable
MD5:C676F0B5E348D1CC8B0C1096A5FDECB4
SHA256:757CC673BDC11027CB2CD28CAD3C4E5A658792B1B16A8753E182596ABF3D5D83
2800mshta.exeC:\Users\admin\AppData\Local\Temp\nc.exeexecutable
MD5:C676F0B5E348D1CC8B0C1096A5FDECB4
SHA256:757CC673BDC11027CB2CD28CAD3C4E5A658792B1B16A8753E182596ABF3D5D83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2800
mshta.exe
138.124.180.20:80
kekw.ru
NO
malicious

DNS requests

Domain
IP
Reputation
kekw.ru
  • 138.124.180.20
malicious

Threats

PID
Process
Class
Message
2800
mshta.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2800
mshta.exe
A Network Trojan was detected
ET TROJAN Possible Malicious Macro DL EXE Feb 2016
2800
mshta.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info