Extracted

• • Target
    _25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6.exe
  • Size 111KB
  • SHA256 25012a8ec2d926e5ee222cedde30ff0d09bb4259801406212c61c08e7aaf30a6
  • MD5 a9439f5392386a14820987965880a63b
  • SHA1 480ea433419a0065a248eed5dc2fc6a8d8c5b704
  • SHA512 b3324618d89dc7ecbbed6f2629b2b27d5e353385f65b040b30331a0a20b1260818befcd90a05d81787f8293336f24f60099a67ce93a5466a460bcd6c6b88dbff
  • SSDEEP 3072:kPATDicE1py8mMTgRNJ6aliIHNH5BNny3V5X7:kPAT+j1pyKg34aljvCVZ7
  • TLSH
    T179B35A5B63E530F8E17782798AA11A46D772B83607219BFF07A0464A1F237D18D3EF61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecution

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2