Extracted

• • Target

    ba5ccc923fd027bd5c206d5797ef934d2638e49bf2d9c62f490f65851fc11d38

  • Size

    88KB

  • MD5

    8bb827dd4f22289343a9b03732eb59e0

  • SHA1

    3d5e66266856d15a12b894f09ead759135e06f8b

  • SHA256

    ba5ccc923fd027bd5c206d5797ef934d2638e49bf2d9c62f490f65851fc11d38

  • SHA512

    11197a15f261fd82240b61dd95f6e32dd7c2b03acfb1a64cd56e46e9412657eb4ececfa7d37f6400a36c5d3f33907f618e4b4a2033e35bfb289a88d3e472b8ef

  • SSDEEP

    1536:gyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAGkWvgrPE4nWHPNc2AR:gyehv7q2Pjx45uoDGTj+5xtekEvi8/d2

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2