fc6bd9adde12ab5dfaaf01917d575cabeace103606e30296200cc60d4d860b73 | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 22:19

Sharing

Report Analysis Logs

General

Target

muiplayer/css/poster.jpg
Size

126KB
MD5

a7f890b31588ad011dc0d62628fab326
SHA1

583bde67029107a2960475b425070465e72596ff
SHA256

8ba4e40c89077523ffda441754c456cb81964ea9bd69c59f9041bfd53b99f6f2
SHA512

bb732d36f7f407e48c9d457fa0412754cdb98abaa3935d59989ad8809119fbb071885b0c97781d305fa82930c9be2f83e07a13a96a3deffa99a179e03a2e15c8
SSDEEP

3072:CM/KMBPvGrGILHtByVVqmTaS1czguaB/m60:5/7BXmHtBmaS1YBamH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
360	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\muiplayer\css\poster.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download