Extracted

Extracted

• • Target

    2c341cf3f188678c35cdb125b7c9dcdaed7cf44f766041e8ad1427e00955e759.doc

  • Size

    124KB

  • MD5

    1a224a87b076f87c8fadecbed3c9db43

  • SHA1

    43451676f595f9a6d4d01a68856d40984bc286cd

  • SHA256

    2c341cf3f188678c35cdb125b7c9dcdaed7cf44f766041e8ad1427e00955e759

  • SHA512

    52d154f720510ede0bad8641967ed35f81aed4c01e846503ae0b2e8b56a462f7777c25a2ce6498a8ae809e95106fb050dc6e1ba0fe6a98777b82425c9e00f6ba

  • SSDEEP

    1536:vkcaUfWWfXE8DKhfpM7gPgP8MDw/jlQx1JE7vReOr0l77CXXNaHsdUXSIt98iuBX:vVLf/U8GX3ClwH9r0l77AnsSmy/Bwx8

  Score

  10^/10

  discoverydefense_evasionexecutionpersistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2