Extracted

• • Target

    806f40b33359622f698ef99724429ce5fccdb7c6eb5f80c08fe5b0c16c026691

  • Size

    438KB

  • MD5

    51d48cb8b00c400f00ed652b55bb8d42

  • SHA1

    3298d6364c03bc8d7991dffc44f6c22cd7ad79b3

  • SHA256

    806f40b33359622f698ef99724429ce5fccdb7c6eb5f80c08fe5b0c16c026691

  • SHA512

    56b1c94c3e3cb47ca0f0e97934642a3c7d151cbc527be8e8c37790024c4086ceb0cc5d3384dd6af4c9bc4abee38140b1ed4712dcdb2438d1464d8825d2c94f8b

  • SSDEEP

    12288:V947a/JjsLZjXYc7X0/aXCKli04OaZ1XSwbhF0:1urYc7E/i004OSLbhF0

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2