Extracted

• • Target

    createdbestthingswithentirelifewithgoodfeaturesareonhere.hta

  • Size

    206KB

  • MD5

    40eb4da176e3f591e3fc3e0bca69344d

  • SHA1

    616daeccc5d5728d358761c07002ba57f6095d77

  • SHA256

    8e6892c56c8c98976d8f803126afeca1363b6bce6c461512c0258d361982d3e5

  • SHA512

    bc2121a275d81ff4a4e4238192c65746067906ed56092dbeabdc26cf6cb878143229e5fad0770884d55978b46672c0fc11f02e01f6534125657cde75a6f300bc

  • SSDEEP

    96:43F97AKid6lxkzJd6JxkzZtThPFINQy1ynyFd6Dd6kxkzbd6yQ:43F1AKefLhZtTPy1ynyPGgJhQ

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2