Extracted

• • Target

    355e5f0ee2010eef5e5ac2bd555be35ed49104844159c56becd665daeb6a43e0

  • Size

    88KB

  • MD5

    25da6fd2850b8105f345de2c34fbda89

  • SHA1

    f9ab47c9aef8928a97813b42fce055c7c22760a8

  • SHA256

    355e5f0ee2010eef5e5ac2bd555be35ed49104844159c56becd665daeb6a43e0

  • SHA512

    40f4d4d808b3599cb9a2cc3c2b57aa71e1b8d56aa62f2728403495e28d97a1c0a7a6d2ea1bcd2103750c91adb3e6e884eaebcab868031059dd2879e5d41d8b11

  • SSDEEP

    1536:ryehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQC/kWvgrPE4nWHPNc2A5:ryehv7q2Pjx45uoDGTj+5xtekEvi8/dV

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2