Extracted

• • Target

    a146d0f5e344ae93eec7f9f4a8118f69fdd8bcfa9710424fe6d6b114929f31b8

  • Size

    44KB

  • MD5

    13414c6061211ae33931af1fb7e2fa09

  • SHA1

    d553bb1e647c862504857fdda2151eabc8e435d5

  • SHA256

    a146d0f5e344ae93eec7f9f4a8118f69fdd8bcfa9710424fe6d6b114929f31b8

  • SHA512

    39a408693268a20d8961b8b662058edffb726f82a2ace9ca0d1da76e826610526a17fe262c6701e7e8ac191bf1159107f449e951fc452d3a5950c2842c24008b

  • SSDEEP

    768:NNtvo+hzsk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJI4YfuFwmQQc8kJ9acp9acyL:rak3hbdlylKsgqopeJBWhZFGkE+cL2Nu

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2