General
- Target extension-fix-KBSZCL.hta
- Size 3KB
- Sample260803-knef9ssbnb
- SHA256 9c34ca5ea6607f5991dbeae0e44233e4cf15190c55923a7ef4f114cf68a5e894
- MD5 362395d983b936c5af639a375816857f
- SHA1 1584c82b8baaa2e01f97dd0d0cc2bfa0211f4842
- SHA512 13d36f90c5c33910e3e2627840f68c1c4c2f330397ddbf105d467c26c9f56c3181fada740745f6e298fa0fa9c5e33661a82571782aa512b5c59c83814e17d16e
- TLSH T1036135F7BA5652C6BC3289AB1A2F518D50901B062726D5FCF79ADC00AF8CE0D80787D8
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-KBSZCL.hta
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-KBSZCL.hta
- Size 3KB
- SHA256 9c34ca5ea6607f5991dbeae0e44233e4cf15190c55923a7ef4f114cf68a5e894
- MD5 362395d983b936c5af639a375816857f
- SHA1 1584c82b8baaa2e01f97dd0d0cc2bfa0211f4842
- SHA512 13d36f90c5c33910e3e2627840f68c1c4c2f330397ddbf105d467c26c9f56c3181fada740745f6e298fa0fa9c5e33661a82571782aa512b5c59c83814e17d16e
- TLSH T1036135F7BA5652C6BC3289AB1A2F518D50901B062726D5FCF79ADC00AF8CE0D80787D8
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2