Extracted

• • Target

    Po_docs.xls

  • Size

    98KB

  • MD5

    ad791e87a785989bf5dc066db100e652

  • SHA1

    dabe7215a329944fd262906aae16b9c9ec689c0e

  • SHA256

    26daad7f2b88dfa67240b07b416d9261909f0398e17e8a62e29a8e324d49d94d

  • SHA512

    c07fab2453f8efbb4c37a5b53e2f29574c770d07b4ba3ead5b07b2365c8214863f273474091fe54bdafcd024fa236ab4c97e32bd8bbb68f75378247b27d62ab3

  • SSDEEP

    1536:NiqHy1S6F8b2SQrEkawpoXIoAD4qBYs8N3Ff6iugVOUYoFMz7C9Rvrp2CU:3eFHrE2sIo8LQt6yTMvIrp

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2