1583bd6eba58128bde999adb9bcf6928677e34d4b8bdaadcff8eaa7189941439

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85c7aaf45fc315f50253551c02e03823_JaffaCakes118.jpg
Size

28KB
MD5

85c7aaf45fc315f50253551c02e03823
SHA1

26dfa52f8c02180948d01b67011e865bc2529741
SHA256

1583bd6eba58128bde999adb9bcf6928677e34d4b8bdaadcff8eaa7189941439
SHA512

b442795c82a7dc8cda20aa1fa01489cb74fe1fcc5956833cafeb0ce05bae4a1f314fd29fa75e49b42049276908cd52157d258e180a2fc790fb6129c5bb47ffd1
SSDEEP

768:vKw2QfosQjz+TWejM9GewRD7FEmuvN6PXP:vAQfosQOB+U7fuveP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\85c7aaf45fc315f50253551c02e03823_JaffaCakes118.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download