24c4f94de545416dfd664bd6b545fd4264e73e6a998730e9e035c58e03d7c30f | Triage

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 15:59

Sharing

Report Analysis Logs

General

Target

image002.png
Size

7KB
MD5

7e1d6233c93755d30067179b66d4642a
SHA1

ac68587bd8dbf7219772356cde14503231792e19
SHA256

c588ed0a04689e52654c9f82754d787373b05e6cf715c24d551d91d6befb2075
SHA512

a8a3bac6841b56564cf0fc7db602ba93f98fa5a4c25fb5eb51a9c2ddcf0af7e5600e5ce81d8e9fed667edc6497ce6212f469343fb75558ebedca3e59aaad0da4
SSDEEP

192:8nnHNsMzDCrqxSf4zZucgah4xNU8uYeEfLKi7d:8nHkPC4xNU8mQLzx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1256 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image002.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download