Extracted

• • Target

    0bd49dc6f7efe68080f65faf5fdff91f443dd1b4ca93cc9abeb8f15c8889d408

  • Size

    44KB

  • MD5

    7770cf4869f3f257d6c2d3748dd06e86

  • SHA1

    1a337015605b91ada1464d586f8d15be8c851d33

  • SHA256

    0bd49dc6f7efe68080f65faf5fdff91f443dd1b4ca93cc9abeb8f15c8889d408

  • SHA512

    5520e4c7bf1eb1dfd37b6b30f6f787976fc7c5a0ef53152680c7040d2a78f889d7ce7d026020544cddf1eed7d3e6b4ea6031234bcf89c4589ba2b6d69e570a82

  • SSDEEP

    768:ptvo+hzsk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJliNWUuFSmQQcsrJ9acf9acyL:xak3hbdlylKsgqopeJBWhZFGkE+cL2NT

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2