Extracted

• • Target

    76f3a3740caecde18f29723f1c3de2a0c4686cd8ebe334eb7b5fcf69ef983ba8

  • Size

    88KB

  • MD5

    09540abe4eefcc4df4f28660dd88bbf7

  • SHA1

    995aa23533b328bdfa565a02aca3904320a2c445

  • SHA256

    76f3a3740caecde18f29723f1c3de2a0c4686cd8ebe334eb7b5fcf69ef983ba8

  • SHA512

    6fb06b9ede41a9efc3e9b4657dcca1c9e4563b01759cb896c2d0716f6f3516c49d26e451adec14cd33dc4bfb1ebf66cbf0ffe055cffc38f9349622074b542b0c

  • SSDEEP

    1536:lyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQU1kWvgrPE4nWHPNc2Ap:lyehv7q2Pjx45uoDGTj+5xtekEvi8/dN

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2