Extracted

• • Target
    kingsibacktoruletheworld.hta
  • Size 25KB
  • SHA256 a8a6f65005174bee9153f18d6100e984253345b6cc7faa931176f32dc6b33797
  • MD5 0f479b6facb98c01895bac8ae64ca7a6
  • SHA1 91ed43db3336fec38fd1ab80871ecc39f0ad1200
  • SHA512 7102e8270694d0097d8fb9cf4261efc68b37c0c5b58b87fb5b4349579a482a21c91be76427350a05cf2551621b17f5df43d2f4f296263d9e11dea0a56cb9a601
  • SSDEEP 768:iN4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N4N40:YgSt
  • TLSH
    T129C27D1E12B978708616E7BC6A85701DCE24132E6FE396BCBF8985DF4218D16F28DC71
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2