Extracted

• • Target

    c45d31e44d57ed25927e102efcfae85dd155f2496624c3958bdd4076d4e0b386.xlsx

  • Size

    597KB

  • MD5

    b084fdb4d0c9b94ab31e3a762a8ceae9

  • SHA1

    40118c7bde4f52645b341ee5dacca239eeb482ef

  • SHA256

    c45d31e44d57ed25927e102efcfae85dd155f2496624c3958bdd4076d4e0b386

  • SHA512

    c7a0b4175be14c6146a5016bcc733096b68acc1ec1a0c9078e3d8038ca3cb025cbff79ef5a85899a0e1b91c00b3e77086f8af1bf3da0f16030f172ce08dbeb17

  • SSDEEP

    12288:YYoYZa3XGB29qpzJjEsC/KW2ZF4wtho8mDYEX4BLKLQ:PRw32XzJjHC/EHtho8mD1X41KM

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2