Extracted

• • Target

    06623c47be31158c77417823a17e5e1c203068da959bbaaa64743420371e9a81.xlsx

  • Size

    209KB

  • MD5

    5b28aea68f6bcfd8336c85b3722e2a1a

  • SHA1

    823f8e5c8f994193202af76a22fd6e989f5b11cd

  • SHA256

    06623c47be31158c77417823a17e5e1c203068da959bbaaa64743420371e9a81

  • SHA512

    43b5476dc553a68c0be346bd4cb68b72e5974a971ffd0f4dfd46d3ee47cfca64b550da9596e6a1f485118dacd35cc25d579fb175fa044b9c022ccb9aa87d90e9

  • SSDEEP

    6144:xYh2x8eIzSrXvjNC0tc5J68eKZI8DQyfaWlBjhb:xTx8eIzSrtofU8DZd

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Drops file in System32 directory

  behavioral1behavioral2