23cc70b7286d79f49e71557ef6d7a544676104d13ba090f1052baaff4c1e1d9c

Analysis

max time kernel
20s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 21:04

Target

壨/20141119_101200_2.jpg
Size

64KB
MD5

f43a9ee76d2a0e4c7e146bf37ae39036
SHA1

0ba8b8ed5dcbaa0fc1427f6cb383885114f42347
SHA256

f14f7b4807b22f2ab0e522797ce024b8cca8c886058f920fb55d9251d1abc933
SHA512

5b2f41e8a40499953075b7d64df662078cb5a1b60f5b244f3921d2261768e023b8db97973e851a23d4aa0bbe64ad73b9fc7ddf9afa796ac7a6bfe1e6fab0047b
SSDEEP

1536:Vb6O3UVlo/pDfqp6p2CZ1C76vP/30HXDLiUT1P9bnUT5o5fNn9wvBgmbM2Q:V6xwpDyUpx1Q6vn303DLnT7bUTG6p3wP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1236	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\壨\20141119_101200_2.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1236

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1236-54-0x000007FEFB8F1000-0x000007FEFB8F3000-memory.dmp

Filesize
8KB

Download