Extracted

• • Target

    ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c

  • Size

    34KB

  • MD5

    b33bb35523724ec11e6f05291d701b24

  • SHA1

    1841fd745bdf695fdfe7abcd8df375bdddb9648f

  • SHA256

    ba61d36c455000f52f3c5e117f7394a7a265fa77966d8c60a5f4f3aba6aae98c

  • SHA512

    3952118baa9ae59c095acf5daed56965fa2dbe8f485384751cd3b4d2eb88c221986d1fbccf6bc56527b843f5959c27505c80c6f6cfe3f1d2305a6e223b74f1f9

  • SSDEEP

    768:LveWFwP+SKabAk0BuqCXlg+/fs5cClfZw2gmVXqA4LQYgO1mQQpSFeVAmcil:LSP+SKabAk0BuqCXlg+/fs5cClfZw2gQ

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2