Extracted

• • Target

    νέα παραγγελία_86576546576.xlam.xlsx

  • Size

    611KB

  • MD5

    33befe584a0a8e659e29c8ce5129f61f

  • SHA1

    32236fd8f2c9d1b62e4633c72bbe5c38107d56c8

  • SHA256

    70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

  • SHA512

    61d19eddddeee6fe0c63a3671be572ab76fa29b137fac326981f420575c3235034320fc50f2f25c77254f2190b5d8d1373137e54235e7700c4d2428f3b8c604d

  • SSDEEP

    12288:P8BiIRAbnhLSkFsU9qjGLD00o36LAto7eDwUB1m0SN0C1TGcbDMasYGHI:0rMt4m1+o0+0Sn1TTQqGHI

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2