Edit tour

Windows Analysis Report

Overview

General Information

Analysis ID:	1427105
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5840 cmdline: cmd /C "C:\WINDOWS\system32\cmd.exe /c mshta.exe "about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();resizeTo(0,0);</script>"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5728 cmdline: C:\WINDOWS\system32\cmd.exe /c mshta.exe "about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();resizeTo(0,0);</script>" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

mshta.exe (PID: 1812 cmdline: mshta.exe "about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();resizeTo(0,0);</script>" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: mshta.exe, 00000003.00000002.3191233392.0000000009F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: mshta.exe, 00000003.00000002.3191233392.0000000009F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/favicon.ico
Source: mshta.exe, 00000003.00000002.3191233392.0000000009F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/site/autoit/
Source: mshta.exe, 00000003.00000002.3191233392.0000000009EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/site/autoit/#
Source: mshta.exe, 00000003.00000002.3191233392.0000000009EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/site/autoit/3
Source: mshta.exe, 00000003.00000002.3191233392.0000000009EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/site/autoit/?
Source: mshta.exe, 00000003.00000002.3191233392.0000000009EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/site/autoit/e
Source: mshta.exe, 00000003.00000002.3191233392.0000000009EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/site/autoit/eC
Source: mshta.exe, 00000003.00000002.3191233392.0000000009E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/site/autoit/osoft:Windows:Explorer:iconcache_idx.db