Extracted

• • Target

    45e0aa2fea8d2d35cbf3b1c0935e477d857c359b76279e9b71743056c947f357

  • Size

    44KB

  • MD5

    dfc7fc2d7b29aefcb53712d429e5b7f7

  • SHA1

    b216eb80d239b3c9fd9d83be83f058d54efd3a8f

  • SHA256

    45e0aa2fea8d2d35cbf3b1c0935e477d857c359b76279e9b71743056c947f357

  • SHA512

    c91d6226c407be7ca5abcb1c868e75b6ebb378eb7470fcb8bed0c66f8f05568ee5d7825e668e4fe26d1cdeb7589922042491510b7021b8efa5a6cf447501e852

  • SSDEEP

    768:atvo+NzZk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJBquWpuFlmQQcwFJ9acL9acyL:yHk3hbdlylKsgqopeJBWhZFGkE+cL2No

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2