FIREEYE_RT_Dropper_HTA_Wildchild_1

rule FIREEYE_RT_Dropper_HTA_Wildchild_1 : FILE
{
	meta:
		description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
		author = "FireEye"
		id = "f570baa5-7d58-5a0a-b713-769e62076f76"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar#L4-L24"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "3e61ca5057633459e96897f79970a46d"
		logic_hash = "60c1d53b8a43b9b7518f3260a4d61c6806641ee894a2a331a3a0a2ea0aff9d99"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 5

	strings:
		$s1 = "processpath" ascii wide
		$s2 = "v4.0.30319" ascii wide
		$s3 = "v2.0.50727" ascii wide
		$s4 = "COMPLUS_Version" ascii wide
		$s5 = "FromBase64Transform" ascii wide
		$s6 = "MemoryStream" ascii wide
		$s7 = "entry_class" ascii wide
		$s8 = "DynamicInvoke" ascii wide
		$s9 = "Sendoff" ascii wide
		$script_header = "<script language=" ascii wide

	condition:
		$script_header at 0 and all of ( $s* )
}