Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 3

• External Systems
  • Sample was identified as malicious by a large number of Antivirus engines

    details

    13/60 Antivirus vendors marked sample as malicious (21% detection rate)

    source

    External System

    relevance

    10/10

  • Sample was identified as malicious by at least one Antivirus engine

    details

    13/60 Antivirus vendors marked sample as malicious (21% detection rate)

    source

    External System

    relevance

    8/10

• Hiding 1 Malicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Suspicious Indicators 3

• Environment Awareness
  • Reads the cryptographic machine GUID

    details

    "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• System Security
  • Modifies proxy settings

    details

    "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "mshta.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "mshta.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
    "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
    "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Checks for a resource fork (ADS) file

    details

    "mshta.exe" checked file "C:"

    source

    API Call

    relevance

    5/10

• Informative 15

• Anti-Detection/Stealthyness
  • Queries kernel debugger information

    details

    "mshta.exe" at 00017231-00001692-00000105-6484732539

    source

    API Call

    relevance

    6/10

  • Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)

    details

    "mshta.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "00000000040000000400000000000000")

    source

    Registry Access

    relevance

    3/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• Environment Awareness
  • Queries volume information

    details

    "mshta.exe" queries volume information of "%WINDIR%\Fonts\times.ttf" at 00017231-00001692-0000010C-12244135904

    source

    API Call

    relevance

    2/10

    ATT&CK ID

    T1120 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads the active computer name

    details

    "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")

    source

    Registry Access

    relevance

    5/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Reads the registry for installed applications

    details

    "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE")
    "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• General
  • Creates mutants

    details

    "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
    "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
    "\Sessions\1\BaseNamedObjects\!IECompat!Mutex"
    "Local\ZonesCacheCounterMutex"
    "Local\ZonesLockedCacheCounterMutex"
    "!IECompat!Mutex"

    source

    Created Mutant

    relevance

    3/10

  • Overview of unique CLSIDs touched in registry

    details

    "mshta.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32")
    "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKCU\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}")
    "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}")
    "mshta.exe" touched "Browser Application State" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}")
    "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS")
    "mshta.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")
    "mshta.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS")
    "mshta.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")
    "mshta.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS")
    "mshta.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS")

    source

    Registry Access

    relevance

    3/10

• Installation/Persistance
  • Connects to LPC ports

    details

    "mshta.exe" connecting to "\ThemeApiPort"

    source

    API Call

    relevance

    1/10

  • Monitors specific registry key for changes

    details

    "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0)
    "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0)
    "mshta.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0)

    source

    API Call

    relevance

    4/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

  • Touches files in the Windows directory

    details

    "mshta.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
    "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"
    "mshta.exe" touched file "C:\Windows\System32\rsaenh.dll"
    "mshta.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files"
    "mshta.exe" touched file "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Cookies"
    "mshta.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui"
    "mshta.exe" touched file "C:\Windows\System32\oleaccrc.dll"
    "mshta.exe" touched file "C:\Windows\System32\mshta.exe"
    "mshta.exe" touched file "C:\Windows\Fonts\times.ttf"
    "mshta.exe" touched file "C:\Windows\Fonts\StaticCache.dat"
    "mshta.exe" touched file "C:\Windows\System32\en-US\mshta.exe.mui"
    "mshta.exe" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\History"
    "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"
    "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files"
    "mshta.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"
    "mshta.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"

    source

    API Call

    relevance

    7/10

• Network Related
  • Found potential URL in binary/memory

    details

    Pattern match: "http://ns.adobe.com/xap/1.0/"
    Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#"
    Pattern match: "https://bcorp.fun/1/f.hta"

    source

    String

    relevance

    10/10

• System Security
  • Creates or modifies windows services

    details

    "mshta.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")

    source

    Registry Access

    relevance

    10/10

    ATT&CK ID

    T1112 (Show technique in the MITRE ATT&CK™ matrix)

  • Opens the Kernel Security Device Driver (KsecDD) of Windows

    details

    "mshta.exe" opened "\Device\KsecDD"

    source

    API Call

    relevance

    10/10

    ATT&CK ID

    T1215 (Show technique in the MITRE ATT&CK™ matrix)

  • Queries sensitive IE security settings

    details

    "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")

    source

    Registry Access

    relevance

    8/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Reads information about supported languages

    details

    "mshta.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")

    source

    Registry Access

    relevance

    3/10

    ATT&CK ID

    T1012 (Show technique in the MITRE ATT&CK™ matrix)

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.