General
- Target extension-fix-AY1HRW.hta
- Size 3KB
- Sample260803-k37rcssfqc
- SHA256 785d104d0e108d2b76939154fc8800b0c6a9d348b52cc7b58966011d7867e0e4
- MD5 b8e4bf047d6955c04ca92d3c8ada2796
- SHA1 7f9d8c015a4e5a7029cafc83e5917079ae03942a
- SHA512 d06f9dc1184031ae49d5a10202c7c235200f061999145d112d7338a6dc8e32864297619c04c8191b59f312053713457478250fd63aeb98a747c9438919327c3c
- TLSH T1336187F3BA4682D6BC329A9B6A2F408D14940B426366D0F8F297DC01EF9DF5E44787D4
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-AY1HRW.hta
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-AY1HRW.hta
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-AY1HRW.hta
- Size 3KB
- SHA256 785d104d0e108d2b76939154fc8800b0c6a9d348b52cc7b58966011d7867e0e4
- MD5 b8e4bf047d6955c04ca92d3c8ada2796
- SHA1 7f9d8c015a4e5a7029cafc83e5917079ae03942a
- SHA512 d06f9dc1184031ae49d5a10202c7c235200f061999145d112d7338a6dc8e32864297619c04c8191b59f312053713457478250fd63aeb98a747c9438919327c3c
- TLSH T1336187F3BA4682D6BC329A9B6A2F408D14940B426366D0F8F297DC01EF9DF5E44787D4
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2