e973c721f811421a0461d38877bb79e9b173928dd5c039bf4203a4059b6b6186 | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/09/2022, 00:16

Sharing

Report Analysis Logs

General

Target

milk.png
Size

2KB
MD5

375fd0b5452360387b27273ba55dbcaa
SHA1

31fe3b97539d08d6fb5b401595e2627cae8e0a97
SHA256

e973c721f811421a0461d38877bb79e9b173928dd5c039bf4203a4059b6b6186
SHA512

5c508bef6eaaa74cc4ed8c51cc9131d4bf372124cc5aa6334a1f08d718d763acf2b3e07ece27786775f7f7292288be23e9214f0db0cbe331b8cf7e85e1460f89

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\milk.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-54-0x000007FEFB621000-0x000007FEFB623000-memory.dmp

Filesize
8KB

Download