Extracted

• • Target

    e48e7bd7b1bc694f6a5e4e0a5d46fea3_JaffaCakes118

  • Size

    203KB

  • MD5

    e48e7bd7b1bc694f6a5e4e0a5d46fea3

  • SHA1

    4a94a590731617dd92abcaebfad0ec21814a8196

  • SHA256

    a461e68a56f148dd8229948f29e1afba3ec22bba86556917fde3b00e2c9d5f44

  • SHA512

    86e8aa8d13499de8fccb09a12a4314c86cb29dfa4ed8bcc849c38df0fd31ed021d18c666b6e762e36e34fee1b671b54c0e91355255f8b2c7d17dc32ae3aab9d0

  • SSDEEP

    3072:DSi2y/GdytktGDWLS0HZWD5w8K7Nk9EpD7IBUfkGftl3r+V9S:Wi2k4NtGiL3HJk9EpD7bfd33r+Vc

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2