2de716414a5246e7d4f1d9679a9c5fdefd194c30807331d05798253ebceb87a2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2de716414a5246e7d4f1d9679a9c5fdefd194c30807331d05798253ebceb87a2.iso
Size

86KB
MD5

d0ea5ecfd59f7704114a91e85a697103
SHA1

6d8ff4e7142ba828a35365f847b72bb51890341e
SHA256

2de716414a5246e7d4f1d9679a9c5fdefd194c30807331d05798253ebceb87a2
SHA512

2c80477abd3dbae464675eacbac2ac103746c60d7dd1ea9853b07572fcbd1b06a052ff1e09df3fdb71146ed2f4c084bb72697236512bc703f85065a64c7198d8
SSDEEP

768:nQ9QyY4F/l3Q2ZEOG+hKTmOrfWlKFxOVQ0dn3I:nQ9QMF/9QxMPO7WEFxI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
592	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 592	2304	cmd.exe	31
PID 2304 wrote to memory of 592	2304	cmd.exe	31
PID 2304 wrote to memory of 592	2304	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2de716414a5246e7d4f1d9679a9c5fdefd194c30807331d05798253ebceb87a2.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2de716414a5246e7d4f1d9679a9c5fdefd194c30807331d05798253ebceb87a2.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-24-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download