Extracted

• • Target

    02102024_0128_01102024_AMG Cargo Logistics.xls

  • Size

    1.1MB

  • MD5

    fd46a15cc540277de9cf6aab650c786d

  • SHA1

    6c01d5b481ba9f3bbd50b0e920b862bc73c86402

  • SHA256

    2b654e01c9d81cfb709768883effa81002075617b18ee66c984df588e8283477

  • SHA512

    9d18efeef19c995a9e925748e5d160bac8add4fbe16e045a6d874942b647ff1446725ddc271d5dcf469104d8cf872b4a12a46604b01c7d0d172eb57e5b86eb9e

  • SSDEEP

    12288:CmzHJEGIkqEwBYI4mwMUuzTZ2aTJwOIx2D3DERnLRmF8D93lVIum/OLGlJfTz0y8:1/KenJETJwfx2bARM8Z3CjzINS6Sv

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2