6ad7ed2fc3f1392bdddf4b7e691f1a0d29a7cede57cec22c34455858a6054cc5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ebb24d6ecd51b83ab48ac9c4ff4db0a_JaffaCakes118.jpg
Size

10KB
MD5

2ebb24d6ecd51b83ab48ac9c4ff4db0a
SHA1

4dfacc6da44cc36b8b6be0be963d67efeb92cc37
SHA256

6ad7ed2fc3f1392bdddf4b7e691f1a0d29a7cede57cec22c34455858a6054cc5
SHA512

487a27d38d233928a4245d38b42fece454408a605108326edf875d52b612d736c33a0f015c4a3ddadb3f00b6c9f1b13cc8ae61d04d5440b15a0f3a7916d5fce0
SSDEEP

192:Cc8HrE2hHe4gVk2eLhPIUQc4yuMimdl2tMdHdaGBeKrGhX8Y:C1E28Vk2exrQJpHmuaLIKShXP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	rundll32.exe
2652	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\2ebb24d6ecd51b83ab48ac9c4ff4db0a_JaffaCakes118.jpg
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2652-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download