Extracted

• • Target

    0001.xls

  • Size

    1.2MB

  • MD5

    fb16f7b0fbcb2ae5d3b185392e4543a5

  • SHA1

    f5e0e6247b2fd7ec74fc687ba0f63d8c05cc3fe0

  • SHA256

    8f4cb3b0aaf0bdbbcc6d080385fab14ae0cf71d8e46770902ade7f5e4099b5da

  • SHA512

    f20b0cd4b5030f517997783caa172e5415bfaefd38cf791c983948ae3a20967fe16840e283e6e4833f0d73d0ba7513f49e212f0bd6db7f1d9a1bf8e473668bb5

  • SSDEEP

    24576:G1852p5l2JsykgMpRptnPskUcZnujf9VYdHk5Xqx5Q:G1O2p5l2oFpB0kUcIf9naT

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2