8ff53520131185a3e30f150f584bcc5d65ce81dafe80945701c0df0575544fd0 | Triage

Analysis

max time kernel
127s
max time network
95s
platform
windows7_x64
resource
win7v20210408
submitted
26-09-2021 12:20

Sharing

Report Analysis Logs

General

Target

蔑愕卦痰漩.mp3.zip.jpg
Size

14KB
MD5

e3804750aeed089267dddccbde17112a
SHA1

38cc9bc67c20ddca273f0b13612bf29891c3f8fe
SHA256

8ff53520131185a3e30f150f584bcc5d65ce81dafe80945701c0df0575544fd0
SHA512

7f87c1404a340da25cb9b4f591aba0ebd21fb3f7e2a8f8632b2d34bc25cf319b7977e9c42c72b6470c696e66da3db7c08e7a50b922ded5c0a426404c8d69f7fa

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1824 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\蔑愕卦痰漩.mp3.zip.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1824

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-60-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/1824-61-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download