7eeb815008135fc4664a472a8f199f76cc631baee274da9f3399257601721cc1 | Triage

Analysis

max time kernel
4294131s
max time network
26s
platform
windows7_x64
resource
win7-20220311-en
submitted
21-03-2022 18:59

Sharing

Report Analysis Logs

General

Target

MuOptinet/Data/Item/red.jpg
Size

4KB
MD5

f4a08e2f6e4fafa979601ff9392fbe58
SHA1

f979e8e04931a462804bb8e3af8e54822a11f40f
SHA256

2757713f04ff57ea12ec537126a5e402ecc57554bb73749c2661b0bcdc429c1c
SHA512

cc99875da4aebf85eb8ede2c90c7e58a18f831a49101a64979d0cca3b537bdecf057e9e28e15e7ac216ff57af8ff24ab5d81627815a2f354dedc1fd457b65b30

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
756	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\MuOptinet\Data\Item\red.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/756-55-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download