3952873719ebe020a1a4207f8c20adc4e025c8a9eeb787edfd45bd0b771b3d1c

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/09/2022, 13:32

Target

Discord-QR-Token-Logger-main/resources/template.png
Size

123KB
MD5

9ed2a8d45e1340e4f4cb3182b0fb564b
SHA1

6895927c549a87bdae75f152d92f6f124566b4f8
SHA256

b39f91ca11e5cba565d510459ce2baabfd6fa8f5faead47fef7e2f4e1073be4c
SHA512

ebbb25a2000f8244b1d8077595916aa06f471fbf20e760a4c4b17d96b5294b437b1abbd280c220a24e743cc74e605fdf96ec87223157542ef0acadadb8b3260a
SSDEEP

3072:w7QfdR89SmO8DRh6FCTNMcOCwU2p/DLDNGQ9z:MovnshWINnOCH2pDNv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Discord-QR-Token-Logger-main\resources\template.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1928

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1928-54-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download