c59c77aadb75b821197d3eb90e0b00c437a6bd742a5b5d8f92ee8f3ba850bf52

Analysis

max time kernel
24s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:55

Target

4ac614cb5e89d92435dcb198fd921b5a_JaffaCakes118.jpg
Size

9KB
MD5

4ac614cb5e89d92435dcb198fd921b5a
SHA1

787d52c50898212d54b6ab13385afb5bb4d7dbd7
SHA256

c59c77aadb75b821197d3eb90e0b00c437a6bd742a5b5d8f92ee8f3ba850bf52
SHA512

2a9b778c057e2484f41f3509ffb94d75a2037e269c2d73b464324e55878e49b40e42962a1e76eaa88f506d9636389e8164800a2541fdb4286eb0dc06b18114d5
SSDEEP

192:j+jVmoBrE+XpKyaqvCfi2xmaOCKrGhX8Y:j+j31XpjaQhGKShXP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\4ac614cb5e89d92435dcb198fd921b5a_JaffaCakes118.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2612

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2612-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2612-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download