Extracted

• • Target

    74797e15e5b212239e3354233e722d56147440398c2d7eda8873d726c451da67

  • Size

    438KB

  • MD5

    0781e48bff4089188229288b5bbe428c

  • SHA1

    fd8b8081e802444372dbb8722a5e9ce58ce20261

  • SHA256

    74797e15e5b212239e3354233e722d56147440398c2d7eda8873d726c451da67

  • SHA512

    b6d54f6f0dc284a0434beaf28c264ad4eff8228e8e32a9e745738e782cba39377b733111c15f16b20aa50a0c8b5c28c79b7529ad776ee4a875168fb91488266d

  • SSDEEP

    12288:J947a/JjsLZjXYc7X0/aXCKli04OaZ1XSwbhF0:ZurYc7E/i004OSLbhF0

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2