Extracted

• • Target

    54c31192614180e8a0b6ab14671407ce2bfe264e233f25b2455cd3f435e8d30f

  • Size

    35KB

  • MD5

    a69904f12a2f66aafdfec78695ec7d52

  • SHA1

    e663f556817dd9cb4aff8bc0745916143c4b1773

  • SHA256

    54c31192614180e8a0b6ab14671407ce2bfe264e233f25b2455cd3f435e8d30f

  • SHA512

    6e8560e7b07375d1a8c37ff6d05e09f77dc5c63feff0b3ee35fc44e324465626870735794160c5935c4b78eacf3f891a6af89f29a606cf67846bc04dea8122f1

  • SSDEEP

    768:ztvoeyUk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJOWuPid93:rTk3hbdlylKsgqopeJBWhZFGkE+cL2Ni

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2