7eeb815008135fc4664a472a8f199f76cc631baee274da9f3399257601721cc1 | Triage

Analysis

max time kernel
4294247s
max time network
320s
platform
windows7_x64
resource
win7-20220310-en
submitted
21-03-2022 18:59

Sharing

Report Analysis Logs

General

Target

MuOptinet/Data/Item/red_jewel.jpg
Size

4KB
MD5

17627a42088de54bee324be9263db914
SHA1

023f866daedcba8c5549daf5ee546abd42e2acc0
SHA256

f6a0def177ef68b5ef2e627e0c055ea043d4937a186a173b7ffeb58df6043041
SHA512

64621939a07988a556517b14ec5e889bd246520024728d7bcfb322fbc7ece99a3e5dbeb33fc4ed5ed728d11abb17ce87f41ceee435707e4f7563f1db67bc3e76

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\MuOptinet\Data\Item\red_jewel.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-54-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download
memory/1804-55-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download