Extracted

• • Target
    23a1fd4a0bf876dc70d98f8c22a2612cc99da210f7ea7f53c4fc7d73a6d251d4
  • Size 468KB
  • SHA256 23a1fd4a0bf876dc70d98f8c22a2612cc99da210f7ea7f53c4fc7d73a6d251d4
  • MD5 95d03be43329755632acfe44daebd5f0
  • SHA1 422492ab938954a5c1d6a3c1a6acb1e10f8b5bc6
  • SHA512 b496dea6f0f2247bbf96d8214506a2d83dc8ac9c22a07b28ed9f39b1c15b923f467bd10b9d750ee999b39b49ce568d037687a830b620c998fb51021a97029fc2
  • SSDEEP 6144:jhuDfH+uqwN9Q7CbPYxpwSUcQ4iUPRYuo:ja7q2GYY8SUwiUPw
  • TLSH
    T16AA4A4B800C918A5E2DBC0807EAEFD6412B6F5D7CEE78D6413ADE3720979B66BD43504
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionpersistenceransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • System Binary Proxy Execution: Rundll32

    Abuse Rundll32 to proxy execution of malicious code.

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4