SUSP_MSHTA_Invocation_Dec21_1

Rule Info

Description
Detects suspicious invocation pattern of MHSTA
Modified
2021-12-03
Reference
Internal Research
Tags
['SCRIPT', 'SUSP', 'T1170']
Date
2021-12-02
Required Modules
[]
Rule Hash
f07d2a9b112e69dac8ce530f02723964
Score
70
Av Ratio
16.63
Name
SUSP_MSHTA_Invocation_Dec21_1
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
59
Suspicious (< 10 engines)
32
Clean (0 engines)
49

Rule Matches

Total
Timestamp
Hash
Positives
VT
57
2022-05-26 10:54:54
688f88846eec9b7610ef70a8ea2e1f76bc015a6537953d17fb7deced1107779b
0
57
2022-05-25 16:37:23
0f5ec08bf1643b7ac0856b31eefde4a659a6976b440727580e00d2382b42fc75
0
64
2022-05-25 13:02:57
4640f67cb74d5752db8897eda4ce8b0a65745fefaa1551bd38370f67d5dce08b
12
57
2022-05-19 12:38:46
64cf191f20d930d08f0a55ff3bfe8e04291577527cc5a7de4ceb1edba9831aba
0
59
2022-05-18 21:36:48
ddb78f8fbb1c58b9069ddc7891418ad4e3c449002b041efd21e20564ca4f95fb
2
67
2022-05-18 07:57:00
d37b73c669722641d66360d254ab5bd174cc9d0d33028e91c2d996a6a206fcb5
40
66
2022-05-18 07:57:00
d20c471c79350fe11bb595be9bb5761afd3fb1d025255322ec3b07e7204fbb8f
47
63
2022-05-18 07:55:49
4859b713f0a1c491b0843c9fb613cdcd9e3536100039f5d884ddc814bf98e0fe
27
65
2022-05-18 07:54:33
c6c3fac1b5803ef1012f505d777006c5196a496c9b7a3ce5bffd3b5c349c775b
36
66
2022-05-18 07:54:33
d5249ac40dd204056ff97dcbe7cc877bb4f58b46e53c60630dfb1fb767bbc5fd
42
69
2022-05-18 07:53:30
026dd1b1dff37f6bdc11043b4ae9a98efce1c952ff81fb2f8087320bd5eb8cf8
40
68
2022-05-18 07:44:03
40da231c8e3f48e28543645584ec095306e8b45379f9968ed390a2e27b6cf4a0
47
69
2022-05-18 07:42:45
36fcfdbeea824f1c3be61de1d9389b472f2441215d9a37da84befddf3a85e65a
50
69
2022-05-18 07:42:45
1c730561f80d31c6a5c7dfdafbaba63a7d8cf737425baa518fa858124d23bd73
47
66
2022-05-18 04:58:12
f5c1e65a9076ac4fe05dd285625dd9932b8e524b188e1d928548a7ad5e3244c6
23
66
2022-05-16 03:56:59
f58d243ffeef1d63aa0ecedfe0357ce2ef3a046d0975f383537efca9ed004f1a
23
58
2022-05-15 07:17:42
2982827b6642526a583aebcd754e8e61c2047dd8a5ec897b3cde01cea90d0047
0
68
2022-05-15 04:51:22
c1c96b889428c4bb8dfc7d3924e06991bdae8e64becb83809a906adb4097609d
15
57
2022-05-14 12:09:23
1082e3f8d343c4141f5f019dabfb935cb42963df63292ab3ec10241533bab670
0
68
2022-05-08 12:12:22
639c138826f074479b1b8c2dc724c46b2cbbcfe435c14545698d4524899a945c
2
59
2022-05-06 17:27:17
c13c2835897fff8bb608fc58baf11feee51e2d5630a1632a89abba7635755f03
2
67
2022-05-06 13:50:49
3cabc41782a283ede9c591d9c1f6bf070d197d70b5019a86f6471a35a83f1470
11
67
2022-05-05 20:15:22
30650fb26d99c56403791e207a55dcd3c3994ea2f2f8cd83a4a4631022297426
8
66
2022-05-05 16:32:14
f73f590198c8f8014dc3b1e8152e133214337391a39024ec96cf5a9c07ff9151
7
68
2022-05-04 15:14:24
b9129cbd9d005b12254884a69672173ba2120b05d9929bb51fb0bca9088722b9
10
68
2022-05-03 16:11:38
30a885e9a97b06d81606bfe8bf2629fab67e0448a5ee9f6025a906746dfb46e8
25
66
2022-05-02 05:51:46
01cf044eb29987d5c7ac634cee24aa356dfc6ed177127e42528f25f930b48485
42
67
2022-05-01 19:21:11
3e2fe574050ce32d4c4dab5482596482087dfa181116a921f8c6fc7f5381345e
14
65
2022-05-01 14:18:22
a141f9965bc1724cb477b8e54017e1102f26315773189466c19733ebf9f346b6
15
59
2022-05-01 01:39:14
dfe1f8707b8c047ac1bf2ad3fe3bca57fb48ee392152aa3de8464210311fb9f5
2
59
2022-04-30 17:23:12
235aad9196688e5bc346a1ac1bd99fc2e224b0896cb4586d1983c3c03a0a8f81
12
67
2022-04-29 17:11:32
57e33c597423ba511b6c4e7dfbfd520f4f94a3d2776dfa271c6510a8e017ffaa
22
58
2022-04-27 21:41:26
4c1dd3d27e6ac074f368ec0631e4bba0bca4b4a7abb55c8183aa2b3f99f42d65
0
68
2022-04-27 21:31:07
37c732a79d7b913d8ce16e3fd5f1cf90a74e34a06ebe3f1de0d91f51b0b34c37
2
57
2022-04-27 13:04:52
61980a8c9e1be9b76943fd3586304b62c307391e46fcd4762c77fafeadd0dc10
3
58
2022-04-26 20:46:08
8314c1050d184477163e2473cdc03e70a0dd451cfb6b73a2180ce9662d19d672
1
68
2022-04-26 16:04:09
24f144620e966c0be4e5a1f6b8305b286eabe1a268fc9be2151828e48e33e1fc
20
67
2022-04-26 16:04:09
e88e0a968da2279a03fb46da07752f31bb93fe55c2aecdf76d353f94ae9f506f
12
67
2022-04-26 16:04:09
484617efc796b10efb7f42baaa3a5edde1dd5ad10fe9b0e52996ce2ff1f1ffe4
11
58
2022-04-26 03:20:30
db0fa4c7d41992d2a86a7b2fe02796dde513e35c6866cc48af687bb1d63ac425
0
68
2022-04-24 17:25:27
fd110bf66e8fde5f57e43f9aa4fa84dc099a870889047327e73ea7445d249fe0
25
58
2022-04-22 15:02:06
862de8b365dfa6b490815c8aa67f1b651936e7ab3d63ec633b80b776c650f0e7
2
58
2022-04-20 12:22:05
4247b6a92f9934af382aca807640bdeb23d585ac37c9c26fae038cead5f73403
0
58
2022-04-19 00:55:01
b25b87d76ee381cf4fc9392637ac20b62e9bc75360b94f496a28079d77f5cc61
0
58
2022-04-19 00:54:58
fc5ee633724196e39193f3797db2e1c7e43bb3bf93d2cb1b6ea66341acf0a4ad
1
58
2022-04-19 00:53:45
80dafdf176d3a64caf62b042fb534418890814c762dd26e5c46a90d61c5037c4
0
58
2022-04-19 00:53:45
5db7a45e864fd57fc5c59bd36052c5774df24dcaaf6602d98aef53bce12d21f4
0
68
2022-04-15 15:48:42
f51d1171314031435e860a0232fcc143b30efbd9dabcb900da8656fb680ebcc4
2
68
2022-04-14 10:10:17
bf44119a17287d2c2bad41f747bd703858c5567df2f99d8c8bc58ed5d3cb24bd
16
57
2022-04-13 09:41:06
5a77a78e4b74d45bd6c70d6a50ee87399e16d09065d8e5442d3b44c3a2d171b8
0
57
2022-04-10 13:55:36
f8c86e81133f55001e4e21ca89dc79b2fa02098f988e4f407ffe368d932ce000
0
67
2022-04-10 00:07:05
0c9f6b8e531efb09a19d8deb82f66e5fce545bfa1917dbb7fd61c177e25a4ab8
8
56
2022-04-09 17:40:37
eb0fd02b9dc312797c1e85f4bde428909548cdb3694cb6892b7b9d5e835b98c7
0
57
2022-04-08 13:18:30
dfd9158da235239b5eef46d188e0321ccd939b38bc71335e0153bf6744d34201
11
58
2022-04-08 13:17:10
db66972f2109942cacd6fc5ab0352182e78617acc56d59794bb24f5ba95bb766
10
58
2022-04-08 13:17:08
3c0b4dc75a27c7d1ee034d4c9b8b03fae3d25e13118fc1bb7158c863826e510c
14
58
2022-04-08 13:17:01
c1074d8351e8521228b1e8d412197558901aabd723a0b0ee759cdb54b0c46599
12
57
2022-04-08 13:15:43
f9dbc6e03c1521886ff0653b2eb88b8a85330515c77547d5104fdbce6d7c9192
9
56
2022-04-08 13:15:43
652e11fb90879df3b3fa066d9b537f5c8ded1d6ac920a17cfc90374a307bf129
10
56
2022-04-08 13:15:43
5ad1ea72ed0350a61dd1e37c23a4381edfa7ae1f1890f654dc1e73f3c7a329cd
12
58
2022-04-08 13:15:30
0a2bdcf4d374ee5d19a0328058059c4bc6a0d7c8f44824dd3163157f6d7759e7
11
58
2022-04-08 13:13:59
25efc044632bf7ceabb30fe71275e0b261a668441bce6b90ef610da27cc0a21a
10
58
2022-04-08 13:13:58
bc7e8ac04c5585215945f2b3be8cdb6bfa46462ae24ac9443922cf97478bf90a
8
58
2022-04-08 13:13:54
f8e4cb883fd2d73492f00bd993961dd0f59d8601a059290ad8c5e8a5f052c18b
11
58
2022-04-08 13:13:54
434ec9f6294d1e4fa09160cd9b6fa462d11ba669d9a644fde80e549e32587fc5
12
57
2022-04-08 13:13:52
33111546a0d916ff1ab09f5f5a23ea8aac5d6de6c2b5a0f0cb9cc3cdc363fbf8
9
58
2022-04-08 13:13:43
5dcbafb1937a0bdeabf2df63f707e473ddcbb62da7f2c68a903ac174f475d939
9
58
2022-04-05 07:46:05
6ff50148360a642cec84890432bdd8b4df05c535321890f89ec6cb25235b6bca
2
67
2022-03-31 11:21:48
6ce2f70d40d0c8f4c329588488c92d353c57404f62e929a14b34d0e956e66bc4
24
55
2022-03-29 06:27:45
dd3fe57906da0b798a14176baeaf40e4bc8230256fa26f6d9c7953231e36c28c
0
56
2022-03-19 04:02:50
05ddf996bf7f23b7d0225fc875b5822321f41a9314ea66b432f79c87c4629729
0
68
2022-03-18 02:14:07
2b5bb5e1df977bf8dd99ff53d8ce25274de04bbcc9bff08050b73e72cb0d6fa9
3
67
2022-03-16 18:59:03
34d5a05d0c0d2fca89305a94a576c7fc98d7d51fd2af04fcc3fd54fe69fd7eaf
31
53
2022-03-16 00:08:29
def2f1584f5f64a02df1af869236604f0af547200cf9876c89507db53b650c08
0
51
2022-03-15 13:26:39
6811e8855c7234b507d8a0662e6d43cf7e33d76f3d6a6c911c0255b63ea75695
0
54
2022-03-12 18:44:38
656b70e849a752e1f529a17ce27a897a1e3c8a383002c3b3d89c25eb34a67254
5
55
2022-03-11 16:26:25
a49853d3ab9ee24dbecfe56b3e8604e9773a14646ac1fbea7d8856f025004d8b
0
56
2022-03-08 08:38:15
6a3463419a7cc8f49b1bb32265ae02e8ca1f83bc08861f62790c35368f4ad260
1
68
2022-03-07 16:01:56
365534bd6ab54a6f4273d4ffb5d82c64577f686a10a8bd8c6d10f5a2dd754304
43
57
2022-03-07 11:45:18
15119cb1070bd85db7c0af7352506e6061544aaa1a1a381c8b9d44d4ab9e1d33
34
57
2022-03-02 21:43:36
4c668da19d7f4dd0c0bdb7e7505e6507b215509a4ad1d764afcdc53c7993349b
0
71
2022-03-01 20:15:07
1ecf712edff4f853bdf4fcb571c4b4af7dd5d3964c58b871ea2957dadfa8b12f
27
58
2022-02-28 19:22:53
4bc674b7292a76f2e232a96e1b83cc10f7022108726a88a72f8916c5f3d71f4a
0
58
2022-02-27 16:14:07
8fecd89532ee41f72ee1bbbc79f0dad5ff7a6115831d6d62d8ce90ce672c7927
0
55
2022-02-26 18:56:29
cda20cff0f9a5ecb251ef319acf6bc90cf773c79dd0cecf4bf8fcc71ca6739aa
0
55
2022-02-26 18:56:27
2d19b029c28be5db407b79f631fbe12adba3e45ae6ca05798e51b6d9bda57cf2
0
53
2022-02-24 15:27:54
eb2010920ac3006143cbd6d8da26f30d16f9ebff24135bed8edc9867464b1b8d
0
70
2022-02-24 15:05:35
4facf4348c1c0a698f3e86263f5cae388feba46e412f94ed68d57812ca831442
20
70
2022-02-23 21:09:12
da434419246230abe5fe9d89f3e4611bf8bb34e756287b448d7899436c6d6657
18
58
2022-02-22 20:49:13
f41c2501cee6ed2ab347df07017bdc677e6c2fe3a9be75e852236e4844c06207
2
52
2022-02-20 23:33:35
d1c1d83c25fc5c3c29039e918b3b1428d1d9efe85f5c0febe4ce19f6a8b07ae2
0
58
2022-02-20 09:09:12
9235c5d9eb18d28ea1a7ab1138f861bbee15d2aedad7e5c20d53ec4ae0db070e
0
58
2022-02-20 09:03:43
22ca35d3e645228d1266e4efcc07fa4c798abac0e729240223cddeb848ec100e
0
69
2022-02-19 05:55:11
247b3062a20d0e260ea44ae2a658e9dd236bd21652fe23ba30d1fa2d3d8445e9
5
69
2022-02-18 07:27:53
b84dcb0b5da06f845eff653bba5623ae5e3530dcaf8b2904e735faf3abf86493
32
58
2022-02-17 17:28:05
1932bc325cc1a340156629ae1b4dd3e9f359535fbbac3bb15316a1fb66ab45d2
0
57
2022-02-17 17:23:03
61c36ea28cc687bfe74c785b8c6bdf2aad337f5bb852c38056e29395651cdcc4
0
66
2022-02-17 11:00:38
c26e98a1a2b7e1bf9820447d951a2e3d36bed944234769bca9ce2c09135df748
34
59
2022-02-17 07:06:06
6550842e564aee0f62c1dc54a3de94a6252d8e6289dffaa9f033dd04892dce6e
0
56
2022-02-17 02:35:45
8612d27e70a02558fd347f32f271197c4fef76333d1bc237210534d4946a2359
0
68
2022-02-12 20:10:49
6b3f6132cf39b8740ca6eda51b80a75ad43c026e3d589439e5efff3d0c4f252f
8
57
2022-02-09 02:55:25
a5290e9b90f48f78a9a54c8848e616be0bd5b0869554939901bf61e78b9980ce
0
58
2022-02-08 14:57:16
69757648c7d2b3e164dbabd6374dab10230d78a9e73aae6dcd36b25b05a522b7
0
56
2022-02-07 21:10:57
b42e5617865e74da7310ed49db519940564cc279c7703934507e343a9c59dee5
8
63
2022-02-07 07:50:48
130745cc32e971781fb8928ca5c288631015910ebcfd5279d4266b7b22e2187b
32
58
2022-01-30 03:31:00
7747fc0fe59dde29926413f71fee61f1188c5a04e79e46eee074b19fa7d7f8bf
0
67
2022-01-28 18:18:00
4be755d2dc6ae3b2d5081e64271e86628d2d4ba917ad9df17e997e522bd41a58
19
68
2022-01-28 18:04:36
ba1146afc02349264fe811da8535a139cc4c00dab57d13abdb89db9b99a38f40
21
58
2022-01-28 14:57:51
b872673dcec6630b9bdbb1b43e306530ab80bb34dcda00a8c2c5c34e390962b9
0
57
2022-01-28 12:23:54
82190d45ed2d888e95e696b98ddd07511d4632aa6036da1994f6a3e297638a2b
0
66
2022-01-25 06:25:53
1d6b166f5363146d8b89e85972e28b859c2c7dc50cc17e63ee98b058e49978d6
23
57
2022-01-22 07:35:58
6d08eaf209601b7acd4cf9ae0b57dcda2ca85d85eafd8b581cbac6e8f2620c21
0
55
2022-01-22 00:03:56
1aaf326d72608c3006ee563f4392b53e2b8b1924759323ab87ba0ccceed5e3c7
0
57
2022-01-17 05:33:47
a578af16971b90844a02dc2a3f8020d941590c0421d3baf907ce99c7fb80c363
13
57
2022-01-17 05:31:32
106382be20a77bc635993bf726518b1d5c3b14ccb1e89aed1369ea084ea454fe
1
67
2022-01-17 05:30:20
a2cab2f401afc21fcd99faf32f6593cf8f203178b46920dee39f8267a6f43f0b
23
55
2022-01-16 11:58:06
a19a3c17f7474e371ebef7726fabb2c23b8e82d9a81df6dfcd19d31d2d67df9b
0
57
2022-01-15 23:09:56
2aebcfbeede15b4b1e4670f0b558114e7a13f0a6cab45af13c1a9c9614906048
1
56
2022-01-15 18:24:22
2a7657924dd9759e5dfcc2d2803882a1818b1fc4021719fb574cc66fdf5bf65d
0
58
2022-01-15 12:00:45
5de0cbed571797bccf9e8849ed50ea9c1828f5c1414aae94fcee0968e2c03d5b
0
66
2022-01-15 08:31:23
0f8a50b10bf06e0d9b0f0eb6c2be6a955b22bb786ad69337b763eb2c6e3e48d1
18
57
2022-01-15 08:29:10
e77ae5220f5e854684daeb190eb881b804f88777145f61fd3e6ab937190e40bc
1
69
2022-01-08 20:07:39
d7dfa4cb7f27e2078df671d8814dc75223db19c3e5df6dcc6ebf385964320ede
40
68
2022-01-08 17:00:36
0e1ccb2b18cbd76b2f85f7a0680303fedc10ee70e4f2372638c27c3b47208cb4
21
67
2022-01-07 10:51:25
ebb32073b3f30732793dd26f4638b4194cc213304c5f7fa050f2abb212624db7
25
57
2022-01-03 22:27:03
543c3b2f28be4ca9112de9a7dcee29a9a8a0185a9835b27ee2f8433828d52aa0
0
57
2022-01-03 22:26:58
51c3a6be9ad4e6a2a56150f7bbbe1a174cf2fc36e26b6a6191c08b304ec42fcb
0
57
2021-12-26 05:43:25
0eb86afc96a6457429ac66fd2aecc5569bbcfd7794ce630e1ce8f1de54d882ae
0
57
2021-12-18 18:25:11
4e6c3d27bf13a11e65b3cbd56d6fc9ec294e72dfaa4a46dbf46b6023b4a0c163
2
57
2021-12-17 00:09:40
2e2e3856992eb639d2af6e0fe862cd7d7d03dc430e65aafadf3284cf19a7faf9
0
56
2021-12-17 00:09:40
46b1ede86228e630a34a96d015a56e0644451902faa9b25f5a29ab79a63a6a00
0
56
2021-12-17 00:09:37
02c83ed0464d0cc44442cacd75ea46a98b81f3b354023a8ce3c628b81bb6f08e
0
67
2021-12-13 12:05:57
3d53a7ed363dc6a345113971b3c4931fa8f00631217143cd61e5f8234988e260
10
66
2021-12-09 13:26:48
4e60c8b989939f849316862d88331a09cc184be5177e132a7214e85902533515
5
65
2021-12-09 03:40:46
9e5a11d1c3e558038ec161462cbbd2df4f89e9c243a7d981de8dedec085dd684
4
60
2021-12-07 16:41:32
42fa26e8ca78b275b6275c3ffa0fb755f8b5d338615125c2ac691a5d44e151f6
16
55
2021-12-03 08:40:12
3248bbb73902acad5f3e1e0c733e8b9e0460a5061488eedb8258b6ca281453a3
0
67
2021-12-03 02:37:03
96148b2efff55e7b9ae27af24a87533e5ba774e4a992bf4c12edbc8a5041f110
36
64
2021-12-03 02:35:59
1433b9e6485e415e47c78092a1cff22174ff873c8f22e4a25f5c052539b8ddd9
35
65
2021-12-02 20:33:50
cb3cff60c04b356bb0951fd363f11d0e6db56d4752903a75799f0df5a5c5e546
2

Rule Matches per Month (last 24 months)