Extracted

• • Target

    Payment Advice.xls

  • Size

    1.0MB

  • MD5

    d6ad3108a8014d64c39ae1fe463112c5

  • SHA1

    f5bb7665aa11ad21d9fa117a6e7b270c533a5844

  • SHA256

    7b75ff23cf680717091181e61002f59e66a118302af798fc031548aead7a6af4

  • SHA512

    3bae03cb73bceae2e54255833d92cb2cf0a6e3b826997b4754909c103508b79734df24bd1e42161a292e30e83232569eecfb1d23d85856564a6b12dfc62b735f

  • SSDEEP

    12288:6mzHJEyfN1YVuBPT39LZEBD3DERnLRmF8DHFg6pvXlc857Jw6b4EJvQJwuXAw79r:9hfgVY3YBbARM8bF9pfW2GH5wa73N

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2