Extracted

• • Target

    473f5d2bb2e7518268fdb7a9fb439b802ffc4f9aa76ac3fcdbbd60d58cc44dac

  • Size

    44KB

  • MD5

    3d2b24d0a1db0e82fa1f254924128354

  • SHA1

    1cecd46eac6c6aadbb5fb6a1869337328400e745

  • SHA256

    473f5d2bb2e7518268fdb7a9fb439b802ffc4f9aa76ac3fcdbbd60d58cc44dac

  • SHA512

    3a8c459a1d67f69b7558832821cc78a3f4571597a9ce4969edc9aea4947ff791b1fe47206c0ef229c5e3f5d13f632c33358be3198ba260a5123c5fd72d644948

  • SSDEEP

    768:Stvo+eUk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJET+juFlmQQcAOJ9acv9acyL:6/k3hbdlylKsgqopeJBWhZFGkE+cL2Ni

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2