bb3d12ac14d38a33ab5b2203beefff924264d1debac31610c72c0d9a8f480de8 | Triage

Resubmissions

23-11-2022 15:27

221123-sv7qdsfd8z 3

23-11-2022 15:26

221123-svfa5scc56 3

Analysis

max time kernel
10s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:26

Sharing

Report Analysis Logs

General

Target

speed-jam-logo.png
Size

102KB
MD5

e6b2eebaa8e922cf7fad2e9f453123d8
SHA1

2391979fbeefb660da1026ce61f310fe8a3d86f7
SHA256

bb3d12ac14d38a33ab5b2203beefff924264d1debac31610c72c0d9a8f480de8
SHA512

98406fa62bea9e452f43922a0d438ac15167136a876a8fdd52bbbc7b8ed3384db4f685fb0a5bff1367c5321379fcc63062f291510903b139aaa7a8e89a849aec
SSDEEP

1536:e1R3OsHbIPyZqKMiWMTpqUhVQCYupv/H7KeONd9a9:ebTbFUZO/VQwpv/byX49

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

rundll32.exe

pid process

1092 rundll32.exe
1092 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\speed-jam-logo.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download