b8a5d926e77cc116212da04efa1ce18b47af12ba2d2b5298d07e09c097e73d9d

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c53edac59d51c015cf9f0cc8acb6200_JaffaCakes118.jpg
Size

8KB
MD5

2c53edac59d51c015cf9f0cc8acb6200
SHA1

cc88c7be10e3b9a213d0f80b5e4b2f9791982404
SHA256

b8a5d926e77cc116212da04efa1ce18b47af12ba2d2b5298d07e09c097e73d9d
SHA512

c913b5ba1a24d6b00110a9dca8b3ffa009c323f563d419519082bea73c76cb055c9c7087701f0d119af8ff4de2d40681469f270955f8a63155645c10f4dc7281
SSDEEP

192:jYEh0D2eI0EfaEyrl3oPtlNz6rpt3K2ZJKrGhX8Y:jDUEE8tlcrpfXKShXP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2080	rundll32.exe
2080	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\2c53edac59d51c015cf9f0cc8acb6200_JaffaCakes118.jpg
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download