General
- Target extension-fix-VPVK3F.hta
- Size 3KB
- Sample260803-k7yz1sshjc
- SHA256 f46f1365f2b2ce6f4f2e5d186090e76e51d6b632490d09e4014e5afb3b85ec48
- MD5 4166909770a8cea3f39bcd445d0b30c1
- SHA1 558b17ba779d987999cb6e0d99b0c3865f4d98cc
- SHA512 42b14fbef2a579215dc8f6ef902dc5ef56b229e603e7d1c8d5d15529b1f6b0adf2e711fa06d55db4aba5171312c629cd317762f4e384f3798db7d1dc9f818620
- TLSH T10C51EFF7BA8692C5BD32899B6A2F119D54941B022366D0FCE6D6DC01EF8CF4D8478398
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-VPVK3F.hta
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-VPVK3F.hta
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-VPVK3F.hta
- Size 3KB
- SHA256 f46f1365f2b2ce6f4f2e5d186090e76e51d6b632490d09e4014e5afb3b85ec48
- MD5 4166909770a8cea3f39bcd445d0b30c1
- SHA1 558b17ba779d987999cb6e0d99b0c3865f4d98cc
- SHA512 42b14fbef2a579215dc8f6ef902dc5ef56b229e603e7d1c8d5d15529b1f6b0adf2e711fa06d55db4aba5171312c629cd317762f4e384f3798db7d1dc9f818620
- TLSH T10C51EFF7BA8692C5BD32899B6A2F119D54941B022366D0FCE6D6DC01EF8CF4D8478398
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2