Extracted

• • Target

    292fc1154bbe613521acfa3ab69da24d_JaffaCakes118

  • Size

    247KB

  • MD5

    292fc1154bbe613521acfa3ab69da24d

  • SHA1

    d89cb8fee32378fab48c4af4073d0b1f4977f2b8

  • SHA256

    58284dd1bedbf2c82204eb15cdad07525a70b52ff1729e051ac101c066531ce3

  • SHA512

    739f5ad0af89e7429e2fe2c67a8579093b1c78b7c85a287e91c2fe46224f334f3f70cea86c9e1ddb6972e4169bd273567c9b40fa3d895173130fb445b0dc58aa

  • SSDEEP

    6144:30Rum7mdLRp1bbSBIR/EHGtCMXgTo8qoFt/etg+7y6aboRTa:30E3dxtR/iU9mvUP7paboRm

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2