Extracted

• • Target

    c192c3ce36fe4b3fe660b6a457f2e76ff8fd456fa2bfecb55d509168fb56fd46

  • Size

    88KB

  • MD5

    ca0d43edd7c6a10e83ad548eef78e7fd

  • SHA1

    839010135fa379fcb42b15243f8856096d6ce409

  • SHA256

    c192c3ce36fe4b3fe660b6a457f2e76ff8fd456fa2bfecb55d509168fb56fd46

  • SHA512

    393d83dbe691a95f56cf16e3239785d74f0edd2be194beca9a29b379e9346a6aea40baf19e0ddc66675f7de1be5cd30bc62a476f25e60c19b9d3a0327eb23f77

  • SSDEEP

    1536:zyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAhkWvgrPE4nWHPNc2At:zyehv7q2Pjx45uoDGTj+5xtekEvi8/dN

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2