7eeb815008135fc4664a472a8f199f76cc631baee274da9f3399257601721cc1 | Triage

Analysis

max time kernel
4294226s
max time network
126s
platform
windows7_x64
resource
win7-20220310-en
submitted
21-03-2022 18:59

Sharing

Report Analysis Logs

General

Target

MuOptinet/Data/Item/sep0202.jpg
Size

21KB
MD5

edeece7c502eeced22a31c9b5aa8e8b4
SHA1

f3098c658c8cb30b56ed90c7b6d6555667fd0515
SHA256

00c4cc058cea2f3807c939085ad1f012349b8082fb5b1ccbc4c86fc2a8e9fdc4
SHA512

9a3db1003d552dfa040a18fed5ba60e7cf2f4d4a277142f92e6d46689430b4212af2b3d6b8d77f40aee96ce705d39beca5e24b69de2bcbc3b0f17492e1f3803d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1468	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\MuOptinet\Data\Item\sep0202.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-54-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp

Filesize
8KB

Download
memory/1468-55-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download