Extracted

• • Target

    9ca5ac2764a3fdcfa154438072ee6439679dc6e920ecc4a753c34eab3b80deff.hta

  • Size

    207KB

  • MD5

    a834a210eda3bb2a9c5a69e046043cf5

  • SHA1

    d3f7e634a214c3edda1a69b496cae5e8f4c58492

  • SHA256

    9ca5ac2764a3fdcfa154438072ee6439679dc6e920ecc4a753c34eab3b80deff

  • SHA512

    6019b4c7788df78c3ea2752fe9085e66b333e7f52a31ce9b4632e1d59b8ab3b44c9a96e6e585a33749840e4af422dcaf14ff0d53a4823d65e96ae70aeea98298

  • SSDEEP

    96:43F97ZLDySraaVxDyIraaVn6cKt1zRoy3yyhDywMDyPDraaVSDyCQ:43F1ZLdr3Dpr3AcKvay3ySGsDr3wTQ

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2