Extracted

• • Target

    9f8125ccbb335bf06504de7636530da31fac9ae3a31db6587f86df389f5907d7

  • Size

    438KB

  • MD5

    d92adc60a1f138720d363bf955769639

  • SHA1

    40b7682bb2f81dd99f0fe45ed8d3b7d106d92407

  • SHA256

    9f8125ccbb335bf06504de7636530da31fac9ae3a31db6587f86df389f5907d7

  • SHA512

    803be2016774024f921c476f424d165a810ef205b8d674e8c2b81041c8f516555def1aa882e34b64a321f6b969167907a1acd452db255d2aa894abe37ed0d0a0

  • SSDEEP

    12288:T947a/JjsLZjXYc7X0/aXCKli04OaZ1XSwbhF0:furYc7E/i004OSLbhF0

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2