Extracted

• • Target
    file.hta
  • Size 8KB
  • SHA256 7fe124a0993d718f9a0056961a9efc3d87970de7af003ea435e3ffd1877219cd
  • MD5 b814cd127063bd423376b50428df3644
  • SHA1 c188e87c421624c272cc7bd8438d5b405488efe5
  • SHA512 05ee16bab7a3b403c46f80b49a0bfed78d64c32d30bbfe7d5ae64eef7cabbcc09f0f3b3622edc88c766c01613294d0f1d9fc85ed4ad07e72ca5dbc3348fed96f
  • SSDEEP 192:/TEORIJ3AdyjiWlDzjlvC9eZl6joyt1T4tSHCw:/TXRIJ3cyjnDzjlvCCl6joM1T7
  • TLSH
    T12F02B5F7BD2AAA38864654ED3979D82CAC70455B485A41397D8C90981F0DBBBC3B03CF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydropperpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2