7f1a57e2fb242de0487f350dae701b02b59c9d0de3cd371b7c73b69b35f96c94

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 15:02

Target
oncometric_curvifoliate_balladier.png
Size 961KB
Sample221019-sekwpadcck
SHA256 373f440ac58d5e2e91ec33c68fbe4977d8e4643e023b9035f537a018cca540f6
MD5 677d7286bdf7402711dcdd0193355a96
SHA1 7078ed0dadb5bf921233cda581993cace70fc516
SHA512 8bd6d13fe53122d4e5ffb75d67df86ee11dcc5e71756861e0ea8b497bc664db0b29971847f7e4f02bd4f052f0aef99b67550b1b0ef632be190d13c25d5c5a4d2
SSDEEP 24576:rVYn34MpdJGWFL70U38zEpd0urvKLtluJHtTQq:rV+9WWRRzLeluJ9Qq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1452	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\oncometric_curvifoliate_balladier.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1452

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1452-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download