Extracted

• • Target

    421895be443167f773741e1681d27ba2052fbef90d4def330cadb3206dbd651c.xlsx

  • Size

    937KB

  • MD5

    b01b76c877321d03dab23c4d1bb26e48

  • SHA1

    faf698726f93f31fc1fcab31e8942d690220fa10

  • SHA256

    421895be443167f773741e1681d27ba2052fbef90d4def330cadb3206dbd651c

  • SHA512

    6756a5eefa442726525208796c7406146407be1a779655a647cdd3caa38a5c761848caf5a978e4cd612713aaef9307221411372859dffa82c860d723b307fc64

  • SSDEEP

    12288:2UXN9WeWy3aJwF1E3Zjy5dbHsu6KGsW+DYavtKVUgGw6M6ozBdUepzBf88SKe:fusaGF1EpyYu67sdDNVK+f9oTptaK

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2