Extracted

• • Target

    Po docs.xls

  • Size

    476KB

  • MD5

    4cbbf7815ee93202eb78ae0815ce9c2b

  • SHA1

    093f0bbc7422766b465332e1c8f608422e702329

  • SHA256

    dc8cc8622001466d8dd715db5cfd1c7e930f1c201fd1a37106f5191ae68a33e1

  • SHA512

    790781e0a6dc840634f36fe5ef9863a1a0e31b471183968f401e757d2ad2d8010224abb98111a7e3d44f4d6d063b455c3f91edcdde34a364c52afa03ce3cca15

  • SSDEEP

    12288:skef66BBGRUdbU6jVzs6dDuipHJ30VQdB:G66iRU5U6jpdDtHt0aB

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2