24c4f94de545416dfd664bd6b545fd4264e73e6a998730e9e035c58e03d7c30f | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 15:59

Sharing

Report Analysis Logs

General

Target

image006.png
Size

12KB
MD5

a346a4e2f7efea0ff1fd9019bb4b5f86
SHA1

73a64ccc7f728e5ea3d45bfb295a4215a61aa594
SHA256

6ed938cc280fedb30723b4088a4cdf7f6654ac2c8edce93c777f7191dec88ce5
SHA512

89273e55db8c9fe45a62560d291cf49174b1359e505b9e740817b9ca75e1c081b8edb2d9ed57d3a1f509005cb8cabec88fac991a28f824f11a638b1a1847e01b
SSDEEP

384:sRCnFegcd8xR6XTqoOhDTZN6yqagw9GnKtBLT2:sRhgcd8+oT+QMUT2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

752 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image006.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download