Extracted

• • Target

    Document.xla.xlsx

  • Size

    937KB

  • MD5

    3f507483c69122665749c74957fecbcf

  • SHA1

    8fa0278a58eb2262edf9d5109653ab6225c4d030

  • SHA256

    35423879af97aa746f2c25ba204b152e8eb36a45bd2e9cadfd9c77fe39ef1604

  • SHA512

    a784545263e79b128fda617020b39eb7558b08821c5906fe02b76a009d6911e71081ace9f0f32af6bfbd160a99afb8ab106bfe6fe270587f9585d3189b6d32f3

  • SSDEEP

    12288:6UXN9WeWy3aJwFNk3Zjy5dbHsu6KGsWmDYaut1Zp3tFtSGj8ahHS/yyy:DusaGFNkpyYu67sNDNw1JFtSELQ/yyy

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2