Extracted

• • Target

    Document.xla

  • Size

    1.0MB

  • MD5

    1c220dca89b554c1365291ead95bfa31

  • SHA1

    98234f8ae71502f109890e1f67a850fda1a2673a

  • SHA256

    c9b46bf282df72278be6af59bb7acb43f5b6405d2567008d6fd56ed440e42377

  • SHA512

    a4979842684119c4c703744bc074ff8abff61bb1ffb514d331f6c319fefe6c9c0ddff0ede403ec88f3756c5dbf2588c1b73e2c4f29280f68ab2cf8fd16e0cc18

  • SSDEEP

    24576:lhfgpB31HbARM8UbCE4ypOkgNAvRioX4:lxMV18Ibrj9B

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2