Extracted

• • Target
    IMAGE_0715205384566.js
  • Size 58KB
  • SHA256 023c2ffe7b6418affcafe78df6d190107a882de63f55c63a266247c22b11e244
  • MD5 475f9e20573a299966b48664a9d75a10
  • SHA1 3bbbf4c2abeeda810aad87e2b7985cbeffacdf59
  • SHA512 2be579cc212b77f6d05a8a318993507336708d6ba2b6ea282e764bd4c55042fe4f25514f0f4657eddc321e5723dd7153bac9bb4472598d529f2adab4bd013514
  • SSDEEP 384:ZrG8cTfx1lW74tduJvsCbb1O4UTKJZ5fsjXsEc10X:aTfNO4tduJvsCbb1O4UTKJZ5fsLsfGX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasionexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies trusted root certificate store through registry

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  behavioral1behavioral2