Extracted

• • Target

    6922bd89361a3fb1dbb856681ab28f4bcfa2d43aef70dcf4f06779e8cb49cb51

  • Size

    44KB

  • MD5

    a4f10961fc8fde840029af9fbd58dbcb

  • SHA1

    1263341bb53e47b5f5f5bbd8927bb69a7f3e6369

  • SHA256

    6922bd89361a3fb1dbb856681ab28f4bcfa2d43aef70dcf4f06779e8cb49cb51

  • SHA512

    215a2fc1b826a125d61bf52b7bf0b149ac038e710688f7d6bceecf73f4b6da62ff779dbf8bc7419c0efa2d2ad59da22338448dc9daecd45d9ebd7f79963d34ea

  • SSDEEP

    768:XtvoefzRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJMtkW+uFlmQQc81J9ac09acyL:3dk3hbdlylKsgqopeJBWhZFGkE+cL2NE

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2