Extracted

• • Target

    fec507ef291a77b7e121fcab7920a54ef6f8c1d539802c45081e8193856e4826

  • Size

    44KB

  • MD5

    c4dcc477def6e9616e360a5ae370fb70

  • SHA1

    63db1968e8f583dd9807e2cdfceae85ff37b87be

  • SHA256

    fec507ef291a77b7e121fcab7920a54ef6f8c1d539802c45081e8193856e4826

  • SHA512

    325716b67b635b4b144ed1ff8f5ea9dad5a33806f02ac0603b6b9afa0e6bb95e33c272c86b33d72ad42ae974e8ea6f498748e6577578bfd26fe9e1a6cc1e96c2

  • SSDEEP

    768:BtvoefzRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJMtkW+uFlmQQc81J9ac09acyL:Zdk3hbdlylKsgqopeJBWhZFGkE+cL2NE

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2