Extracted

• • Target

    DHL Shipment Doc.xls

  • Size

    684KB

  • MD5

    a064fe438f311ba1c878dd8128c21d2c

  • SHA1

    9c80a9b91e0bcdbfb5da53285c0ec521aefa100f

  • SHA256

    e3c29ec01ba1b41c8af9b4fc05dd4325069f4528cf7ca0c74713e6b0cc4aedc0

  • SHA512

    d47154b5f9127f6a023c87235034d1d2b804d8160fbb49c2ff4ec405c02da3e6bc5c154aa29254ff40325d41396d52aef1928f3fb8deae3c85348b55550f2243

  • SSDEEP

    12288:AuHbcbiFv+MIFx+tMiGSa7waxlvV43IGBHDSTLfim4++j4YKKTvWrHPqHIiB:pBFv+MIPyGSeMIEHGLfiz++dK+vWr4B

  Score

  10^/10

  defense_evasiondiscoveryexecutionphishing

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Drops file in System32 directory

  behavioral1behavioral2