General
- Target extension-fix-ZYRZ1F.hta
- Size 3KB
- Sample260803-k31ytafb77
- SHA256 aaa6e3223b62195ae80a6afba9e1f61c1dc221658cfadc398f0349fa964bbea2
- MD5 3ca15930e75a33258a8ad7a5f7af5630
- SHA1 76a9f381d2ee3720108eb73105e2b8251950a62c
- SHA512 9c0d829a8e27ed16aae3b5f843f1123767572708b2e9d8bb4f75731703e10be122dfa971bf9e68712a332928c874d669876ebabda0b3b72e40af6c5c3a67ef9f
- TLSH T1CE5163F7B94293C1BD32899B1E2F608D049927131366E0B8F2D6DC05EF8CE0A41B57E8
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-ZYRZ1F.hta
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-ZYRZ1F.hta
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-ZYRZ1F.hta
- Size 3KB
- SHA256 aaa6e3223b62195ae80a6afba9e1f61c1dc221658cfadc398f0349fa964bbea2
- MD5 3ca15930e75a33258a8ad7a5f7af5630
- SHA1 76a9f381d2ee3720108eb73105e2b8251950a62c
- SHA512 9c0d829a8e27ed16aae3b5f843f1123767572708b2e9d8bb4f75731703e10be122dfa971bf9e68712a332928c874d669876ebabda0b3b72e40af6c5c3a67ef9f
- TLSH T1CE5163F7B94293C1BD32899B1E2F608D049927131366E0B8F2D6DC05EF8CE0A41B57E8
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1