Extracted

• • Target

    4a4234be7be60472dc063c2dc72858ea_JaffaCakes118

  • Size

    197KB

  • MD5

    4a4234be7be60472dc063c2dc72858ea

  • SHA1

    d0b2aa2ceabbd3e0d3122d4c603d16fd79819d4d

  • SHA256

    98d5a7d2fb0bce75bf762a151d99e8425588886c15066b07424b8fcf1325b8aa

  • SHA512

    408dae9ba467ce146b1e5d126977d5fa304f989f7546dbdc82195510d0a2e3f197c78bf55c6d8d0cc87620b8936a282ab9878165b881a4c456e817e46c5d7093

  • SSDEEP

    3072:1Cp2y/GdyDktGDWLS0HZWD5w8K7Nk90D7IBU3LgxFVtYsqNpoxb:sp2k4DtGiL3HJk90D7b3WIsqkB

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2