Extracted

• • Target

    Payment Advice-RefA22D4YdWsbE5.xla

  • Size

    645KB

  • MD5

    a9a9c2318ac29160ece850c60e6b7aa6

  • SHA1

    67701eb4f6813927c5262edf55d9943146f521a2

  • SHA256

    b0cd17647fc69ec21565ca141e88795eaf36084fb4d179198e988ab449d46483

  • SHA512

    c5db07d40516e468835e827fbf9643a442c4ebbd0c2941c97f4d00010fbe66b032be8a1fcdf568515f727810a7d7f0bf0c2707ac40a20c55616fb72c85166c1c

  • SSDEEP

    12288:UbWNHd0zBRlrOiVNYNPPg1O+R8G7kN/eTXjWxMyPg+8FlX0iv6p:8sd4rrV6NP41ttkN2TQXbEb

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2