Extracted

Extracted

• • Target

    Microsoft_Excel_97-2003_Worksheet3.xls

  • Size

    36KB

  • MD5

    4e5efb8250aa5094deb1dc99e5786830

  • SHA1

    42124e78ce95be3600258770a002ae01f5e70652

  • SHA256

    0fefe416888a41939d0d7143846844edac1b4ee1ea5fd8f98a893ade7a62d34f

  • SHA512

    cdba63c4ee4620e85b0af3c08911e237bf0b373187efcad9983d2d6bd9aa5238283ef08ba12e00c04ac4bbb41aa10008ce68a984be70de24d86ee3e6ac2c167d

  • SSDEEP

    768:1pz9l7Vbta45G/d9K1EghHsYwiSLSpO7Zp:1pzPzzWdqEghCiKTt

  Score

  10^/10

  collection

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2