Extracted

• • Target

    d6ba8947a94f5e830264a54ab3d321d50e7b1fe8b719bc160a4fedad45b05535.xls

  • Size

    848KB

  • MD5

    477a65eebac6498e30c1897c52fe07de

  • SHA1

    f706f65cfd40d74f8c41f57c1f17365432078d2c

  • SHA256

    d6ba8947a94f5e830264a54ab3d321d50e7b1fe8b719bc160a4fedad45b05535

  • SHA512

    485e9b5801e6be76dc17a049e391698729e12e37eb00fb48499fa300677b4fa85a31d4c58af10645e6cf3fa45410ffd6b3618989f69fd0eda1be86e0089e5cc3

  • SSDEEP

    12288:wmzHJE+CzldAD3DERnLRmF8DZJhuia3LziVNtzFrA3+VUdC:7czlubARM8NTa3QzFrpVH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2