Extracted

• • Target

    ebd0a35379140cc925f8a8c5404640cfe79f290801e5ea3e03ae1ad5feb5662b

  • Size

    438KB

  • MD5

    e25044ef4a143de9d53e12116b21f93f

  • SHA1

    f84b20b7d5a508d6548b1c9cfa9ea643657c53d3

  • SHA256

    ebd0a35379140cc925f8a8c5404640cfe79f290801e5ea3e03ae1ad5feb5662b

  • SHA512

    4804ec32a593cc01634526219c931cb7a9eb29abcf6c40289c64f61581212389e4a8cef31747cf5654f74015d9bafeb3eee4df9a6a8cbd23499da5bce6ca8a99

  • SSDEEP

    12288:M947a/JjsLZjXYc7X0/aXCKli04OaZ1X7A7hFc:murYc7E/i004OSE7hFc

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2