Extracted

• • Target
    E Statement85683.js
  • Size 11.7MB
  • SHA256 9a034154de5aa81b68dc76bfafbbdb82b4a59ea2f9fef90e65c8c668e48039a0
  • MD5 b11674e96e8716ef7c2ab2de0a3ff8e7
  • SHA1 a7b767acefb57d3bab7f4141b8d446f4ad02f7bd
  • SHA512 d14f5c7563a8c4fa7bc82410490092303f5c70c10fecfd6a76bcba9ab1c26e979222cfbdf95c1684da9be6d3d2b5a85d9a6739b1e20c84eda12c6da2b95b5da1
  • SSDEEP 49152:8PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP8:9
  • TLSH
    T109C6F1C98EB05D7DABB90F2D68BA0DC4C5906FA63D61F5E5407AF803862366930B7437
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2