Extracted

• • Target

    4b16985eec0292ca52fc60157b89d8c5f52b9c4476734393387760858e7de87f

  • Size

    42KB

  • MD5

    ba52be719fb0d561972975cdceef6e10

  • SHA1

    e6d5d95e45ee83c428c33c6742596a6c2103583c

  • SHA256

    4b16985eec0292ca52fc60157b89d8c5f52b9c4476734393387760858e7de87f

  • SHA512

    85d9ea5abac52ef28ba61d006482ced551ed1b1f6601a3ea21809e5ea30c1810851de63e13f817df0a5b6c932483b0550a08ebe123e920ea039217bdfe474760

  • SSDEEP

    768:Ltvo2Jtk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJf9+WSuFlmQQfMPJ9acV9acyL:jPk3hbdlylKsgqopeJBWhZFGkE+cL2N9

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2