Extracted

• • Target
    file.exe
  • Size 111KB
  • SHA256 b392341db466c7ccac5a414f282ff9cee3719252cf80f1229658ff094f40edc8
  • MD5 d77012aae7fd8d218252849d448a7510
  • SHA1 7fc90af70103f82d4872dfb0051e50288bccf6a3
  • SHA512 2d20e9bb3c09e51bf65ad3623f2b4328fa6fa08057b47707abd2aa9f7188d1234d37fca57fa1e19df34e6a868315fb81c8bc607d84f2069e19260f2a0a7da3e7
  • SSDEEP 3072:pPbn980OvKScAGyd24V1KKy8B287mIecJep:pz9QvKoDrKK/9mh
  • TLSH
    T1A5B35A2B63E530F8E477823986914A46E772B8351761AFEF43A446561F236E08D3EF31
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecution

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2