General
- Target extension-fix-39KQES.hta
- Size 3KB
- Sample260803-ltrjfsfe96
- SHA256 51e04d53d99e1f171203214ecd64641d123a3f634e97967e9d05b2a789c1f0d2
- MD5 dca443930be4964ad77003090fe936ae
- SHA1 17ab95ab9960f944a7a2f84198ee56e4de237b71
- SHA512 18d1babdbcd8d8697f0b344b159cf77a038da87715f5049e6992f715c4ff12c0e553a963d881d32a0a5df021d1894dc700dcb120ca0c93243303f8d7704c2526
- TLSH T1556134F7B94A82C6BC328AEB1A2F519D109117021366E4F8F696DC00EF8CF5D45B83D8
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-39KQES.hta
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-39KQES.hta
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-39KQES.hta
- Size 3KB
- SHA256 51e04d53d99e1f171203214ecd64641d123a3f634e97967e9d05b2a789c1f0d2
- MD5 dca443930be4964ad77003090fe936ae
- SHA1 17ab95ab9960f944a7a2f84198ee56e4de237b71
- SHA512 18d1babdbcd8d8697f0b344b159cf77a038da87715f5049e6992f715c4ff12c0e553a963d881d32a0a5df021d1894dc700dcb120ca0c93243303f8d7704c2526
- TLSH T1556134F7B94A82C6BC328AEB1A2F519D109117021366E4F8F696DC00EF8CF5D45B83D8
- MD5 SHA1 SHA512 TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2