cfc373715baafcd8c896f3601ecbf472c4dfdaa51fbf75b00429bca1b9f8c02b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d6fda292249d3a9f7a7a422b956b68f_JaffaCakes118.jpg
Size

6KB
MD5

2d6fda292249d3a9f7a7a422b956b68f
SHA1

9692b1a43320161ad02dfda8efcb80200acdfe4f
SHA256

cfc373715baafcd8c896f3601ecbf472c4dfdaa51fbf75b00429bca1b9f8c02b
SHA512

a036d4a04fe86bead291384d93d75346f26d8d0f1ed85ec588eb8134ffa20e800eea779fbc751cd9d6a8fe79e131daa5d0c5cb70572026c534994bded108eabd
SSDEEP

96:hqEwGqgIUW9dQvcmn1d7lhYK75Rb/3ULJYiJoBmaIfY1xJMCIKrQNH0q8Y:0t96WnSdnDl97PT3KmfPHIKrUD8Y

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\2d6fda292249d3a9f7a7a422b956b68f_JaffaCakes118.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1720-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download