Extracted

• • Target

    f329e4b08afc7dca5caa97e88e589f237fc60d0178addb01a769f17691981d55

  • Size

    35KB

  • MD5

    37c6ff0b9bc51d0fcb452256f18a598b

  • SHA1

    53eb945d5f264f9bce3ec8da311544d3aa6d3f4d

  • SHA256

    f329e4b08afc7dca5caa97e88e589f237fc60d0178addb01a769f17691981d55

  • SHA512

    6c21282c8a5052703299122cd25f03ba1ffccbbdcfe670ae68f001953e246695b1685a37669061a1eb7cd8893776da04f963a1592a4fdbca1e514601ef42a632

  • SSDEEP

    768:Ftvo+/zZk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ9QCv/1f93:t1k3hbdlylKsgqopeJBWhZFGkE+cL2NO

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2