Extracted

• • Target

    xBA TM06-Q6-11-24.doc

  • Size

    354KB

  • MD5

    d0f2558af01fafc92df8d82c60deb2bf

  • SHA1

    a940bde8c8841e05199fa545fa521441f474d09a

  • SHA256

    af5bc41229045ab88d9c81992fdb442eb814a9cd765e8172480641359b44b6be

  • SHA512

    76bea085c98d8350fa1fbbd9f64297ef215252e7ad6dd05ee124a7ddcbbc0c49518fe1841776a56d0feed156c6a880dbce306bbdc59529175dd5a29185053be7

  • SSDEEP

    3072:A1LnrgVqOj/5cAsFNM8AaG1mryxZB/0LuQIeavuFbKrppVNxd8vMW:A17OjhctN6uiBpJ2KTXxd8vMW

  Score

  10^/10

  discoveryexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2