Extracted

• • Target

    ebdde483075c4e4989d66aa8d905204a_JaffaCakes118

  • Size

    127KB

  • MD5

    ebdde483075c4e4989d66aa8d905204a

  • SHA1

    8dbdc9875fce1de0bd61ce33a10b4a3d14bd8e31

  • SHA256

    739add20d743a8d00b6fc26c0e0985b6876748fe5fee82b81c62b49cb151f571

  • SHA512

    2511b413f089d4c9805d42f6290df49000d850e1ee4d1bada66b8fa93a53ebceb4befc1d5a05504ed1d47b59e823f3a9cbe3850588303ac005369e13d89409f4

  • SSDEEP

    3072:h77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qUYxsEDhSeVJlY9uX:h77HUUUUUUUUUUUUUUUUUUUT52VDWSeB

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2