cf25efc17aff98f289fff81bbac09ba8f0e6b9f75f8cc0314a36ef8348b73e1d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension-fix-XXCN90.hta
Size 3KB
Sample260803-kncbxaeh45
SHA256 cf25efc17aff98f289fff81bbac09ba8f0e6b9f75f8cc0314a36ef8348b73e1d
MD5 b3daef4e2ba8554999c0e8a19ae44d1e
SHA1 a9bdba6e196917f36b19c556b3bbe3a5972e8505
SHA512 92e9d12032a2317ab301d8a29525cd3929e9757c7b124ab46c9cde5acf4886b57403dcd1855cd2825f7140184cac7b6eb6d4e6a94a67e5576c781d642bcdb099
TLSH
T13A6103F77A4A92C2BC3189DB5A2F109D68840A462376E0FCF2C6DC41EF8CE5984757D8
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1932	mshta.exe
21	1932	mshta.exe
23	1932	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\extension-fix-XXCN90.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads