Extracted

• • Target

    11db61702f58cbcc8038f5ad77579dd4ba47d15342818e0f81c9f47c126cb805

  • Size

    44KB

  • MD5

    e8dcd02b7c612cc1368d5fbd8577510f

  • SHA1

    2d68229cd9d846226ffe908092677ccf0ebcb783

  • SHA256

    11db61702f58cbcc8038f5ad77579dd4ba47d15342818e0f81c9f47c126cb805

  • SHA512

    9040c4ec7e2f62845a076ca543483f3e7bd58fc19256c303309b71d25dcba3b688687b66a8ecaa0f536ed3b29934dd4102f08d75077667195596f8eb76500e7e

  • SSDEEP

    768:rtvo+bzRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJpQDguFlmQQcYNJ9acI9acyL:bBk3hbdlylKsgqopeJBWhZFGkE+cL2N+

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2