80c6ab59e840ae105e8f3ca0a6206301dab2a48b2125dd3edf27ff4217e7e57a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

443f07798f4c88d76e951a18b34fa96b_JaffaCakes118.jpg
Size

6KB
MD5

443f07798f4c88d76e951a18b34fa96b
SHA1

ea3a73b4d13b2da2cb90a80627726a9fe0e6cdc5
SHA256

80c6ab59e840ae105e8f3ca0a6206301dab2a48b2125dd3edf27ff4217e7e57a
SHA512

aee2e8f159083aff7d494c5e9c16f03c5dbd4476ad7509152456fdde0d49d5852f3823f3892d5d5a130968cbe332e2b24012fd242e4791511e1c08c27d1bc4c8
SSDEEP

192:LQD/cl93T6kvAHA90hu5hohM3gbYdYoiAURXHj7hc7jHhSjLlj+jlxjt6:La/c/3Tig90hu5hohM3Hzi3RT7hgHh2p

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	rundll32.exe
2096	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\443f07798f4c88d76e951a18b34fa96b_JaffaCakes118.jpg
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download