Overview

overview

8

Static

static

1

extension-...MS.hta

windows10-2004-x64

8

extension-...MS.hta

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    14s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 09:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    extension-fix-79WKMS.hta
  • Size 2KB
  • Sample260803-lapkravyet
  • SHA256 7a8e9a5dc6871167b13e22c301a00c70365c6311ff1674259b903f52a6164548
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwaredefense_evasiondiscoveryspyware

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 28 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\extension-fix-79WKMS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Badlisted process makes network request
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5736
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3644
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4152
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1040
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5280
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1100
    • C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\spteszxi\"
      2⤵
      • Views/modifies file attributes
      PID:1060
    • C:\spteszxi\spteszxi.exe
      "C:\spteszxi\spteszxi.exe" C:\spteszxi\spteszxi
      2⤵
        PID:1124

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Size 1KB
          • SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B46811C17859FFB409CF0E904A4AA8F8
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
          • Size 528B
          • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          • Size 174B
          • SHA256 e478295b393930c9c83d1be77c9d312942a412c340e4eae441262ed6f2b1f8e5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B46811C17859FFB409CF0E904A4AA8F8
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
          • Size 170B
          • SHA256 282698a2e67fe9bdfc64f0332ede98d6f3513febaf4d7e392eea7d52c4e0cc4f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          a1.zip
          • Path C:\spteszxi\a1.zip
          • Size 494KB
          • SHA256 060a6a6ba67fef0823f940fdfbbf3dc419d094ba2b108bf442f4d26fe8c617eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a2.zip
          • Path C:\spteszxi\a2.zip
          • Size 1.3MB
          • SHA256 d8fa9065304a96bb316cd20b139e0a381d4bf392dff1bea256c3b15bef272371
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a3.zip
          • Path C:\spteszxi\a3.zip
          • Size 2KB
          • SHA256 a331e30b1e9d1214a9cbf81fce30f71b0dc6bee8d1cbbd724a8fd319a2a53a52
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          spteszxi
          • Path C:\spteszxi\spteszxi
          • Size 1.3MB
          • SHA256 30af0a4b9b7c7d8cf41c169be3d51c03d9dabd0c18ed699b31850b618b5db55e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spteszxi.exe
          • Path C:\spteszxi\spteszxi.exe
          • Size 957KB
          • SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1124-109-0x00000000066E0000-0x00000000068A7000-memory.dmp
          Download