General
- Target extension-fix-1TYDVR.hta
- Size 2KB
- Sample260803-llevpatekd
- SHA256 e4a9ec0ceab89c0b17d8490fbd37e0c254b49a45b936f7bcae5b9de5cacaffa8
- MD5 d92e36ed16ee6361e2a0a31a898d64fb
- SHA1 477b37eeab987f1e762f4cbfd3b114a236f2543a
- SHA512 35f60aa45825d4515c169312e3686b70d1a4f16eb0a238f0b463b2a6f3758e5352c26282df876926a893e53f533088f6e2ba9ed19c5380d613a68c003fa3e8f6
- TLSH T1A35190E7BE8243D6BC31599F2B3F108914950A472399E1F8F697D800EF88E9D88743E0
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-1TYDVR.hta
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-1TYDVR.hta
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-1TYDVR.hta
- Size 2KB
- SHA256 e4a9ec0ceab89c0b17d8490fbd37e0c254b49a45b936f7bcae5b9de5cacaffa8
- MD5 d92e36ed16ee6361e2a0a31a898d64fb
- SHA1 477b37eeab987f1e762f4cbfd3b114a236f2543a
- SHA512 35f60aa45825d4515c169312e3686b70d1a4f16eb0a238f0b463b2a6f3758e5352c26282df876926a893e53f533088f6e2ba9ed19c5380d613a68c003fa3e8f6
- TLSH T1A35190E7BE8243D6BC31599F2B3F108914950A472399E1F8F697D800EF88E9D88743E0
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1