CLEAN — ab8c1e7153223aeb1c7aa3298fb2d0d5f75e343d972f72d7d83c2ebb7244b833.hta
CLEAN — ab8c1e7153223aeb1c7aa3298fb2d0d5f75e343d972f72d7d83c2ebb7244b833.hta is a unknown sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (21/100). 1 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
ab8c1e7153223aeb1c7aa3298fb2d0d5f75e343d972f72d7d83c2ebb7244b833 - SHA-1:
6e581ac9465ce958dd8277b30b972987388ac4aa - MD5:
43d762633240b3636e8650f448f112b8 - ssdeep:
1536:1qNNNqNNNNNNNqNNNNNNNNNqNNNNqNNNNNNNNNNNNNNNqNNNNNNNNNNNNNNNNNNN:Bp - TLSH:
T1584EA95E8E16D0B9A5D1E062D20CFBF721281E7DC64296DA13F6D9EC56CE03D032E849 - Submitted as: ab8c1e7153223aeb1c7aa3298fb2d0d5f75e343d972f72d7d83c2ebb7244b833.hta
- File type: unknown · Size: 630919 bytes
- Verdict: clean (21/100)
Detections (1 of 53 engines)
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The clean score of 21/100 is the fusion of 1 weighted signal:
- Embedded network infrastructure: https://dpaste.com/BPLVB95LY.txt - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
23316 behavior events · 2 ATT&CK techniques · 39 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- dpaste.com
- static.dpaste.com
- c.pki.goog
- yr.c.lencr.org
- yr1.c.lencr.org
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
Dropped files
- C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\9G746KYB\css[1].css -
b1275442b11218f38dab35c8eb2891ee4754a99851ecb382abbe790cdfb6ad43 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 -
47f6f60af7939f17e227cadc6901feca13036ade88f8adc0bfd7a6647196303f - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E -
8a472205e3558186e8b76c05e254f37f1dbdc4b44cd013ff9c0bb3072fc014ab - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\425F9F0DB4A6739FCA824D9831E2A9A6 -
e19e2047840e3a7d4b9e1c23a0b159003a0f3710d8c111a8069506a2dc472a2f - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 -
a6f8f5d4ffd1e825ffce9a55861f16aa4dbe67871b1696b976194dd8be1fdf29 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1 -
e77c6306bb6008133003ffa2f93694e76d1c09b4dfbaf01cb931cfed7766f003 - C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\normalize[1].css -
f4d7e8250f8f124f8b7d087e5e260766a34b079fddc43e7b20d8c18ca1e92e51 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA -
3368e880ca5ada58c19bc5f4b7ef7c68d6d1b56ab0600509a1f7fdf8c8e93cb2 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 -
3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e - C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\skeleton[1].css -
10207d6db44e2c69bcc0ea046c77074719478331aa6290ed3538034f20f3d308 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\71AC60943B52326209690570E2963316 -
93a0799604119044d81306b875cca9414d46f576d4d284f87af51413983a561c - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA -
1b9148b2c1cc6ddff3ebca2c6fb1daf6c0a980923fcdeddd07152977d7a6c02b - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1 -
108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_44F84527B9D1A5107012929AC9B9BF7F -
01c81fb42d3ed1cd535ace60f2a061755d0586ac904c4a5967b1581c97bff481 - C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\425F9F0DB4A6739FCA824D9831E2A9A6 -
ad2a3a4c3c96d8ffb8b26029d1e1a6896abeb492a6d14400503b4246583bb5cb
Embedded URLs
- https://dpaste.com/BPLVB95LY.txt
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787748950&P2=404&P3=2&P4=CFhJ6kOlx6wAHZJzAUJELfpAxymr0gSpWzhGOQdt1%2f8UglJmvlXfQr4En4kFyVkltgbhqpYSbMXhYBy%2buwrQHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/r1.crl
- http://c.pki.goog/wr2/GSyT1N4PBrg.crl
- http://yr.c.lencr.org/
- http://yr1.c.lencr.org/14.crl
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787749034&P2=404&P3=2&P4=S1qg6kA4FV%2fgvnh4iYnI%2b%2bT%2fqGHrKM4UwE99ci8YPGkeIr6WdeUzIGjyZAVCzQqzn03w0Kmx5hLKxEzlNd84eQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- dpaste.com
- static.dpaste.com
- x1.c.lencr.org
- yr.c.lencr.org
- yr1.c.lencr.org
Embedded IP addresses
- 57.155.104.224
- 4.150.223.103
- 92.223.78.30
- 52.123.252.197
- 4.230.171.124
- 4.144.132.223
- 74.178.76.128
- 20.184.175.15
- 135.232.92.97
- 20.236.44.162
- 52.123.128.14
- 40.99.134.18
- 52.123.129.14
- 135.233.45.221
- 162.159.142.9
- 203.26.79.13
- 74.179.71.159
- 52.148.114.188
- 135.234.160.246
- 35.173.69.207
- 103.180.114.1
- 142.250.195.234
- 104.17.207.5
- 172.64.149.23
- 172.217.25.195
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report