Extracted

• • Target

    4d86998a295608296e073f20d5ae6b0d15fd7a44e10e0bc980462b6567b2a5b6.xls

  • Size

    843KB

  • MD5

    2779226058bde97e0a493f3e3d8c4d66

  • SHA1

    d1e5d2604b7ab8aa8d13dccb8e7b85062af3e13e

  • SHA256

    4d86998a295608296e073f20d5ae6b0d15fd7a44e10e0bc980462b6567b2a5b6

  • SHA512

    e1ba222ad48daf56465375346a86842e89cd0afc35132cc8ba2d557e52f461a331304cdff5676fc6b9e00509fdee4766be35f9f3c6405fae00a6324737d3085f

  • SSDEEP

    24576:7oAyXsPfh6BV9qLzONUpSa5S9B+Q4ri27B4ObmfR:2kQTcLTSeQYikmp

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Abuses OpenXML format to download file from external location

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2