General
- Target extension-fix-G4QPG4.hta
- Size 3KB
- Sample260803-lrrrfafe75
- SHA256 1697c56c61f462e4efddea314f247d62d5a16cd949cbc1b5660471fa387cc96a
- MD5 1a5892a247a73ab35584ca94f163c28c
- SHA1 ef087c63cc5be0d467c3d064b7e191b389765caf
- SHA512 51412bffb239fe639fda7063fc1e648d32a1e87dea110748a12992f1941b9cb9a121626e2866e0c7a750f19560d58692025b257bd6b3911c8a24ccee268626c4
- TLSH T1D95179F7BA5A56C9BC72899B1A2F50CD149417022366E4F8F796EC00AF8CF4D40797E8
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-G4QPG4.hta
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-G4QPG4.hta
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-G4QPG4.hta
- Size 3KB
- SHA256 1697c56c61f462e4efddea314f247d62d5a16cd949cbc1b5660471fa387cc96a
- MD5 1a5892a247a73ab35584ca94f163c28c
- SHA1 ef087c63cc5be0d467c3d064b7e191b389765caf
- SHA512 51412bffb239fe639fda7063fc1e648d32a1e87dea110748a12992f1941b9cb9a121626e2866e0c7a750f19560d58692025b257bd6b3911c8a24ccee268626c4
- TLSH T1D95179F7BA5A56C9BC72899B1A2F50CD149417022366E4F8F796EC00AF8CF4D40797E8
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2