Extracted

• • Target

    7b2d140ba3e0b4d4314218b60f89e57491385f357a277d8caed2c2d950383739

  • Size

    596KB

  • MD5

    1ae6847360fe3bb54193d6009b0c024c

  • SHA1

    9a1b6a797a07ed45ca653f961837f8cd0a8d181c

  • SHA256

    7b2d140ba3e0b4d4314218b60f89e57491385f357a277d8caed2c2d950383739

  • SHA512

    4c3c081453f6c560c5f9b8cb33a4749cf1d8c25836da4df67034cb8ed3ae1ae82c17b593e483afb461e1ba69ba5bedcc4642b70547ae07660ac5453b440bd548

  • SSDEEP

    12288:2KuRV8lIiUy6at3sbD91hmnF0+3KZ3BhP3CZ8UUqud5yM:pIA6m3sv7hmnFbwh/CZ8tWM

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2