Extracted

• • Target

    6889974ddc269eae29f7a949b34d04bc_JaffaCakes118

  • Size

    94KB

  • MD5

    6889974ddc269eae29f7a949b34d04bc

  • SHA1

    bb88e3ac46fc503308959e7f964b4130a4b39357

  • SHA256

    4c58c854ad7652ac73829058b405f7b2dd40e803ef3be318090ee2ee43de1a07

  • SHA512

    08b7bf8a129a97ba4450a04c080e1e31fc8be1325037536b7da4ff2d3ba7e938e081a4adaa90713d7bd3f96ab808299503537dbf9cae8970b613e299ced18ad4

  • SSDEEP

    1536:xXDMeO8oY5C6OJsdBpZW2aMQs666yT+t3hieCnpYjSKxrtN:J4eroY5CTsdA2OI23hccT

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2