Extracted

• • Target

    05a33226b5454fbaf9a395e541921d5d6b9f88f25534eff36ebc8bee8ac7f66a

  • Size

    88KB

  • MD5

    fdec2214b1c7cd06d30f5f29d33fbcc2

  • SHA1

    45643e5678fe830a6a7344fdb356481befa1c9a4

  • SHA256

    05a33226b5454fbaf9a395e541921d5d6b9f88f25534eff36ebc8bee8ac7f66a

  • SHA512

    aa627461c8aca624c6cf1040df644825ab67d6f70275cf02a05a6e2243fe2f6c95c2f46ba3a578c5566d72eae9ced2fc7291c287dbf959b14dc2c13266fd5087

  • SSDEEP

    1536:zyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAekWvgrPE4nWHPNc2AB:zyehv7q2Pjx45uoDGTj+5xtekEvi8/da

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2