Extracted

• • Target
    ewe89_438948_394_3949a_3293s_3239001.zip
  • Size 161KB
  • SHA256 ee522c877e87530dd7918c22ed953a69eed3a4e967114a477da2a31cf95abd0a
  • MD5 21063fb10adb68c3aa9a27b3ab985fba
  • SHA1 5e401ea1c80cbb951e162a14cd6b7f0d0056f081
  • SHA512 1ea144886b1fb8e73ad6770b37edbd13182cddc9ee53593ed7cff2178fb019d87722e81d7d4ce158e365fc776a2429cfe673ca5a20f2054df5c67dbe7603cecb
  • SSDEEP 3072:EBzZg8bombZlKj7abUYE0UeMVPpqYz+YYze67:EBzZzhXKj7abUYpU7Rq3ze67
  • TLSH
    T1BEF3DF53C410C7C3D49A97FC7A431EE8AF5AAB44F5866EEB25064F9F7E104235A8E06C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  behavioral1behavioral2