General
- Target extension-fix-HIQRMT.hta
- Size 3KB
- Sample260803-lwd15sff58
- SHA256 629809bda3a387e921d0e605e1e9db4c15f24c915da8032515a361bc39a06df6
- MD5 2c3bee4e38bcae640ec2a14380076f86
- SHA1 cee426fc78e456590a1c9da70642fad14e317da3
- SHA512 1408f95500ad57497ee8258a4659afa1e452f2efaac5195353800980ea12a1cea8ee5ce9b4531e1e8cbc438d0e2a191883bc837e26191940154c6b23e51bcb8b
- TLSH T11151BCF7B95A42C6BD32999B5A2F508E509023021376E4F8F3A6ED40AF89F5980743D8
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
extension-fix-HIQRMT.hta
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension-fix-HIQRMT.hta
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target extension-fix-HIQRMT.hta
- Size 3KB
- SHA256 629809bda3a387e921d0e605e1e9db4c15f24c915da8032515a361bc39a06df6
- MD5 2c3bee4e38bcae640ec2a14380076f86
- SHA1 cee426fc78e456590a1c9da70642fad14e317da3
- SHA512 1408f95500ad57497ee8258a4659afa1e452f2efaac5195353800980ea12a1cea8ee5ce9b4531e1e8cbc438d0e2a191883bc837e26191940154c6b23e51bcb8b
- TLSH T11151BCF7B95A42C6BD32999B5A2F508E509023021376E4F8F3A6ED40AF89F5980743D8
- MD5 SHA1 SHA512 TLSH
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2