Extracted

• • Target

    f87c631160fdd3f73fbe19a6a4cc84b07dd49ad38a3cc2c4ba0cd91c13012116

  • Size

    88KB

  • MD5

    643b428e5ee69fe294f1a9bb85451dfd

  • SHA1

    b13f723ab3baacb13280d1ab1b08c27cffb1acb3

  • SHA256

    f87c631160fdd3f73fbe19a6a4cc84b07dd49ad38a3cc2c4ba0cd91c13012116

  • SHA512

    2da622bc7e872a30e64fd07ca856c65fa482d5a86e0d01de7faa43bb400b7b2ee8a2b69afa1034ef61c954c3945cbe5efdf4646255e96332b3ec84ca00769761

  • SSDEEP

    1536:Tyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQ2mkWvgrPE4nWHPNc2Ap:Tyehv7q2Pjx45uoDGTj+5xtekEvi8/dM

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2