7eeb815008135fc4664a472a8f199f76cc631baee274da9f3399257601721cc1 | Triage

Analysis

max time kernel
4294183s
max time network
153s
platform
windows7_x64
resource
win7-20220311-en
submitted
21-03-2022 18:59

Sharing

Report Analysis Logs

General

Target

MuOptinet/Data/Item/sep0303.jpg
Size

12KB
MD5

c7c33603a14a4d28119756ceff8dbf96
SHA1

a3758eaad705789db5ece5ef3176e474f4f6ac83
SHA256

4f8298de07c43c460334ca9f6f774eb0444e259c58c6a1988001106f8f43b9b4
SHA512

dc698ac845d51488977e3cee8bc089733b5e2dc21bb37c81b420a2643cdd0a91922cf0c2eb24c3b91982a0168db3cad04fc39324b545139aa6c87744247c5926

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1136	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\MuOptinet\Data\Item\sep0303.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-54-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

Filesize
8KB

Download
memory/1136-55-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download