Extracted

• • Target

    e17ace1660b239f015e6886e188002d6aa210c25723e4fe4e7252b185ef98931.hta

  • Size

    206KB

  • MD5

    a67cc7c8b7c0047d1bee23eb85b041c6

  • SHA1

    ff5141beb7b39c95c6ac9934e26a17603ac4309f

  • SHA256

    e17ace1660b239f015e6886e188002d6aa210c25723e4fe4e7252b185ef98931

  • SHA512

    38c06a12ace2b347c90fc52f20bc0a84c037a9c711084348a2122686ad122f64117249535ce797e6c6cf1e554b1b397382d187baef53ef5e0a2d028c8e6bed91

  • SSDEEP

    96:43F97ZkK7E5lKFE5qbZIgrHlcARlNRoyX1K+K9nE5nKLQ:43F1ZNA5sm5DgryAvoyMby5KLQ

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2