Extracted

• • Target

    30092024_2248_30092024_Material list.docx

  • Size

    770KB

  • MD5

    b9ca7824b0cf46ce04ce56e14909efb4

  • SHA1

    20176f284724f65abd77176d3c67633f4584f2b5

  • SHA256

    b7eb625981dd8cc620af32cef8fca1814dbf6d2b853d90c3ed00327d165c5af7

  • SHA512

    e4a9e5dd909fc4724748189adf904b35e52e486700e2471f958857478a4be06877f1efa871038402836416054097dfe63a9b53e9e9eea5d8d1ae32b336430dc9

  • SSDEEP

    12288:JNC5JClLMC5cGm0LpsjYJ46gvycWL5c7PasQB2i4MYJv/u8QdyAxd6mzoGfyS2EC:JACluL0CjY7EDWQisQB2tXuFdyZGh2EC

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Abuses OpenXML format to download file from external location

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2