Extracted

• • Target
    verygreatansweriamthinking.hta
  • Size 808KB
  • SHA256 32d97190dff8cdbf3abf079bad58a162f212a98c8f23c56433f63d43adb2a11d
  • MD5 b04a0512b3b003f04337809e6e7394e6
  • SHA1 0900d8cddee1411fd29aaf82591c8e5876f167b7
  • SHA512 2c5fc67b783bb73b2ae62854c0c75aa0f72ed6354d0279663004a5e4b9a6bcda738fe1fe97eb22e2741fa4a8733a539e92faf719808afe2983db9ab81829115b
  • SSDEEP 6144:gZ9oRtVoRFveoRzvAPO6NcGPO6Salc7PO6G1lcKnvknVPO6dPO6SMkrlchPO6iQs:v
  • TLSH
    T12E05130365850E608B3A27D607F84387B722717AB34399A5FFBE4725EFE5408672DAD0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2