Extracted

• • Target

    bd721206e71b651ab88c11f1fbb873fec3804f88358ae5985c84eb4b7045159b

  • Size

    88KB

  • MD5

    1f05d87ab4411f8adf7d8349d9a9f2ec

  • SHA1

    a2de8ddc8caad8ae4fd5bc0d2791b2d6e9611b93

  • SHA256

    bd721206e71b651ab88c11f1fbb873fec3804f88358ae5985c84eb4b7045159b

  • SHA512

    0d93e7cd1ce07b66916ec3c0b8b57ac960460f5b6bc87e0d22bc3f2bdb6383d07dfd401fa0fd204d57abfd5a9fff0eff4c824f847ba5685cf70e95578626d713

  • SSDEEP

    1536:lyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAGkWvgrPE4nWHPNc2AR:lyehv7q2Pjx45uoDGTj+5xtekEvi8/d2

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2