Extracted

• • Target
    Facture_17062021.doc
  • Size 28KB
  • SHA256 efa78d9ed272969fb2ac62b355f0b9532d20d26ed47d87e3c2d5f1e4b67bbad3
  • MD5 09727593446a5003a833fb6ad80fff68
  • SHA1 ec07a60874477f99a7ca4c9e704fbb9a82e72aa0
  • SHA512 4386b1427010cf3e02c6d03a2886234260efc076b834d51b02af1402662e0c3b0663dc49fa8cb0fe9d161074135ca9f2ecc07d382e116b2f39636d7fb747d688
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencespywarestealer

  • Modifies system executable filetype association

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2