Extracted

• • Target

    Swift Copy.xls

  • Size

    98KB

  • MD5

    524559bfe8623365f3e1569b5b58be85

  • SHA1

    2638ebe72c1df88dd7d9ba66654c55160d41287c

  • SHA256

    752387dc376a39db5dcdf2b0030bef0e516b1331b059fff96e4f87f48126a1c8

  • SHA512

    c2b7f278e9827a53f325c94f736b04451f1021807be5b54c68534e6f2f1f24a51a7977bc762f8dd216d83821be8c85309d2b953117412181848cac877afcc454

  • SSDEEP

    1536:BiqHy1S6F8b2SQrEkawpoXIoGks1Y5jWWTerlEdA5xwiglkk/UlvKBut:beFHrE2sIoGdYkF6y5xtIkk/Oi

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2