Extracted

• • Target

    fec2f38d82e315c3df9be2e24daad5a2ff31d3c5beedd06aff06d18fdb5af8b3

  • Size

    88KB

  • MD5

    a9ed7f4b887b38233898cfadd9892667

  • SHA1

    314ee9542b889c092ebdc2a775aa3c7b5429a1d0

  • SHA256

    fec2f38d82e315c3df9be2e24daad5a2ff31d3c5beedd06aff06d18fdb5af8b3

  • SHA512

    abd0aaf014103457e99f6d9143c85dc614e652359e79a0e37d0d649be8673307537a89cff598895e2dcc1c2f7d52b1bd26428e2099c87740302ab92fb34818e7

  • SSDEEP

    1536:Vyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQIVkWvgrPE4nWHPNc2A1:Vyehv7q2Pjx45uoDGTj+5xtekEvi8/dZ

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2