33ab358c00dbaaf3f9874e13748edda767b7cd831b7524bcf9d33f274dd51269 | Triage

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

image.png
Size

2KB
MD5

fc191cfd8ba0a9675dd51a043e8b0706
SHA1

d050586f263968eae71242b40c56e1eace3b277d
SHA256

33ab358c00dbaaf3f9874e13748edda767b7cd831b7524bcf9d33f274dd51269
SHA512

36f5fc9060c84d612593b766a099a9b2ee4c40bc84f76139dba1ea186ae07ef0ebf4dc7918dc8bf625924593b8a627f50a6ab782008ede5adad2808d3fd154fb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
360	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-54-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download