Extracted

• • Target

    3e41a800ec6a0fc6cebdab5f3db9ee12_JaffaCakes118

  • Size

    196KB

  • MD5

    3e41a800ec6a0fc6cebdab5f3db9ee12

  • SHA1

    89859ef8b0cd9bac82dde95e1cc89076b9a8bf25

  • SHA256

    d3a971e91f47c541df76801e52a72840032f85e684147587c26417c906644908

  • SHA512

    059bd138b711aa6ea9b18689330f296db75b7c3bbd8816f916545f31d379b64aaaacda2fb7a93dd689ca2af9c33f4f9aa0d29e63d2ce1d90f6771d141727038e

  • SSDEEP

    3072:fCXXNhLqI0VZNSU4LOaJncSoA0TfDkNYui4vzP/Id:fUPLqI07NSU4jJntMTfD6Y34vzW

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2