Extracted

• • Target

    a5cc1f3cd556b39bfa7f4e45bc1c33ba655e9f8216e8095e8a8fc4d50ddd77cf

  • Size

    88KB

  • MD5

    e47cc48ac0be84533837d2dc9f36aca9

  • SHA1

    59a5dcbff74ff00e311351482e43dafd1a93c0c5

  • SHA256

    a5cc1f3cd556b39bfa7f4e45bc1c33ba655e9f8216e8095e8a8fc4d50ddd77cf

  • SHA512

    8ee4f62ed4ba589784d27f0dcc6738e65f12413165dda7eefe64e3cbd2a36e2e986aa328fc7db7c8c73d07ec6a782dd1a40cb66bf095f01df471db8222cffc1b

  • SSDEEP

    1536:/yehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAhkWvgrPE4nWHPNc2At:/yehv7q2Pjx45uoDGTj+5xtekEvi8/dN

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2