cb29eb9bf7a1fa4ea45b89617add4eee5fefa37e330e157721415406b713ba98 | Triage

Analysis

max time kernel
4294180s
max time network
134s
platform
windows7_x64
resource
win7-20220311-en
submitted
31-03-2022 04:54

Sharing

Report Analysis Logs

General

Target

download.jpg
Size

270KB
MD5

a7a9e8174e188b0e7a0aa82ac408a754
SHA1

7b5655dc8128cb5640a43613bb7dd1b24b2196a2
SHA256

8c8937cc81571e7c1eafa25e6ac626d88b35ceb3ea7ae606bfb6927a67627b73
SHA512

6722d2670ba4f9016c91dfddb12835f1d978c78918c187cd999504bff93c176e0cb9ea9946401c9599e0bc7edd5fc56ca4949bc6f0b5ab294a1c175e1cb65e89

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

792 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\download.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:792

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-54-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

Filesize
8KB

Download