fda02286558fa92350511263f178c007f411fd1f05d44d8bf0b8053ecf539a1f | Triage

Analysis

max time kernel
38s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 02:29

Sharing

Report Analysis Logs

General

Target

img/a9af12039d49a275069d56ba60e31f46.jpg
Size

29KB
MD5

8214773fb8351069dfb121b9b2890671
SHA1

3cdfc8976ec596dd9aa9501c1098ce082a245d1d
SHA256

a46c896f1f01020dd6437bd87cd78e88b92800989990e0eb6d56180d33858dd3
SHA512

5dc294e2f907fc3e5f23c6f77298971fff9018d1cc0dd2001e2b67aec0d7361272aaf4c95ef3c00ad4334669af9290eff8268fac4dab6d803b4d69f734830374
SSDEEP

768:Lrb+VQtEfBwh0K8SGecoAEe1xIi1GOYve:Ln+2zw/dZ2e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1396	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\img\a9af12039d49a275069d56ba60e31f46.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-54-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Filesize
8KB

Download