Extracted

• • Target

    greatevenevermadeforrgreatthignstogetinbacketothegreat.hta

  • Size

    131KB

  • MD5

    b39c3f8b9214a7a097b0e0c92d6bc193

  • SHA1

    7b253873758021db1fa779229091683bc3b7288c

  • SHA256

    c1a88da841596f0f34b25bd9c04a36a2d8134bf9955b46f2185c331182d3b8eb

  • SHA512

    ea17056a19ae47f4317aad55a971015d48e4e986c6c1bfa0490afdea1045fc4655a6a049ebc0a89ce0fd92029c8dd9cfe973c2c7608c54b79e626657baaa90b7

  • SSDEEP

    48:4vah3d7Ah23jX+Iw81OcNw811aoWeGOyMs1n0J6OpyMmRzAbNxx6TVzok1uHlhiA:4vCt73RjkajCjOQVmPizsNqZ1EjIQ

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2