Extracted

• • Target

    Payment Advice-RefA22D4YdWsbE56.xla.xlsx

  • Size

    1.1MB

  • MD5

    93019ec4bf2082a11f1324fb0f69f6bb

  • SHA1

    0b8890cb852598a7fbd51c77d99de803a6b694fa

  • SHA256

    b9a1aa0417bb7c55a9320c9c6919bf56559bb6cb8064ff087e23bf54e66caf55

  • SHA512

    138ea5ccbf18782bdbe4995008268129825bbf4c82a1ae93afd02f874ce047cbc07482f432919ef536000c5e1bafd3b0c9727f04aa038be0ec881f71456942de

  • SSDEEP

    24576:/yaZxvseowaDIOpUqvBw2L5Lxxg3mJ/Qga9NmAvOJZ:/T0DIOLvBwC5Lrg3mJIg4O

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2