cb29eb9bf7a1fa4ea45b89617add4eee5fefa37e330e157721415406b713ba98 | Triage

Analysis

max time kernel
4294183s
max time network
129s
platform
windows7_x64
resource
win7-20220310-en
submitted
31-03-2022 04:57

Sharing

Report Analysis Logs

General

Target

PAN-.jpg
Size

155KB
MD5

ceceb45ea0cf4d5010772ebaa49d2d8d
SHA1

adc39a03199c295521e496f0d048880d1eda036b
SHA256

68ee51fb589fc13ea759c105a5220167566a7517e9c8040b63b19387019f6030
SHA512

896d45f76db016e0c3c8f55b0b8372f8c3ce4c44b4b82cf663b0fab197e36f6c86604f23c501e877c9350d72e5dcf99cbf255cf5145f79a4c96ae072ed388732

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1452 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\PAN-.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1452

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-54-0x000007FEFC121000-0x000007FEFC123000-memory.dmp

Filesize
8KB

Download