Extracted

• • Target

    fa3a1cb12f4913916856a09b79153c7013cfa7ad13e7be8ce55aea572b172892.xlsx

  • Size

    870KB

  • MD5

    19356d9311743314b3f1e02f6291cc14

  • SHA1

    84f5772ad3dba3531c46665404aee1968b2715a4

  • SHA256

    fa3a1cb12f4913916856a09b79153c7013cfa7ad13e7be8ce55aea572b172892

  • SHA512

    db7b161d3ceb94d942d910681066e3605b0bafaddd445509cf8e9e624d4186c54754642745f67d5f55f31488573d39b4251e20416ff62fba501ca0fa4073415a

  • SSDEEP

    12288:Y9BjmzHJE+CzldbD3DERnLRmF8DqJhuBM3LVpH+fb8biNxsLC16AbaC:YByczl9bARM8eoM3BpefAbQMC16Ab

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2