Extracted

• • Target

    957d3fe2fd3c0919cdff42a3fedf3ae3baf6d556b3e0dab7463274aaa4ab5166

  • Size

    438KB

  • MD5

    03d9e316ad1921ab34b1a50716801070

  • SHA1

    c57cb802f00d64930844e3e46208bc60f61bc903

  • SHA256

    957d3fe2fd3c0919cdff42a3fedf3ae3baf6d556b3e0dab7463274aaa4ab5166

  • SHA512

    ec70a766bad0c34aad5eb38b37afa4121deff424d4c12a456a784262bd611498c9e556f0014816ad4ae3f15e34380548b342efed79a40cd1a48fdffdae8fe59f

  • SSDEEP

    12288:/947a/JjsLZjXYc7X0/aXCKli04OaZ1XyAzhFA:7urYc7E/i004OS7zhFA

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2