Extracted

• • Target

    c0efd41f38466ebdf9a361f924bc0c6b11eb5e68c9b1adb4531df5b302f155e0.hta

  • Size

    205KB

  • MD5

    169a69d33b8480d6ba11f950cb28ff48

  • SHA1

    f74e2a219d7cf49a08bd12dbd4dcde6b63578563

  • SHA256

    c0efd41f38466ebdf9a361f924bc0c6b11eb5e68c9b1adb4531df5b302f155e0

  • SHA512

    7b16659dd7c2bb88870d5c2185b323c078c4b8009bea7ecab534a3705b3c4d585e9dc42acff3122bc718ba884c801db198c73b2630ebecb8f67b17ebcf762236

  • SSDEEP

    48:4FhWsTR/F7gNqXfkwzTqzw4S7u2WAhq0K8Kw99Dd7gZoSdrq67mz9z12gcie9NzB:43F97AcaIN6wfNcoSdrruh2iuRGQ

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2