Extracted

• • Target

    702346eb0afef09975e7fef489c5709aab53b63218f395b3d88ec319ed5610bb

  • Size

    88KB

  • MD5

    a48c5fe65454c59e54ac3322b915cffd

  • SHA1

    6113ddf000724662bb7a9ed3914ab97e35a6ce9e

  • SHA256

    702346eb0afef09975e7fef489c5709aab53b63218f395b3d88ec319ed5610bb

  • SHA512

    bbe81525d23a129857ae3ae72e01471c56521995981804c4067d5e42b0270454c4d8aa86df00471128cb26b6d60eff1ca42951727d31d781c95b0702fe872597

  • SSDEEP

    1536:wyehv7q2Pjx45uoDGTj+5xtekEvi8/dg38EsAeE9jbDXQqBkWvgrPE4nWHPNc2AR:wyehv7q2Pjx45uoDGTj+5xtekEvi8/d3

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2