Extracted

• • Target

    b2ecf49f8361dc153ea556bfe60c7a2fc1cf4cb30cf54f31e8ea62fe7a1d77a0

  • Size

    438KB

  • MD5

    3623fb64938b76fdf3c3f9c5c3e99eb9

  • SHA1

    3b6c77cc25413ed099f0a77ec08fc509428ef5c0

  • SHA256

    b2ecf49f8361dc153ea556bfe60c7a2fc1cf4cb30cf54f31e8ea62fe7a1d77a0

  • SHA512

    d362eefb98bc3b5ef47a5b46ea7e0962932a4ec5187783c623b0849a820707981fdcdbb0c9405b43ffe29d2302ea4bfe187d58e772ba77df03fadd0e273147dc

  • SSDEEP

    12288:+947a/JjsLZjXYc7X0/aXCKli04OaZ1XYQbhF0:0urYc7E/i004OS1bhF0

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2