996f884cba8ebd5af190ece5f3c47b408474e4b8a0ca64949588f521bab6377e

Analysis

max time kernel
47s
max time network
111s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 18:55

Target

10901268/10901268/doyo_thumbnail.jpg
Size

9KB
MD5

b0d1baa2cc613f2b22fddc99d595dda1
SHA1

8df1548958a07d5af9bb6c6892b3a32f4c2b897e
SHA256

076c4777021c22f04a59bdeb2ae508f227d89c9253fa7d4ec8086bf53c56d6b1
SHA512

5e5b416451a9e741966ccd5eaccc9a928cfb37d1133dc3f17a86b78639d8b30ab3ae2484c945a3ca863c0204676b56ed529de513fe7572f9a78dd7df8dac53e1
SSDEEP

192:Z6D++f1Ps/sgoLXg3pv6JjNJE/ogcMV1WmYUpdItzOQi9pYGNMjddlj:Z6q6PSXoLg3pvMowgrV1W12GtzONM5j

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\10901268\10901268\doyo_thumbnail.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1096

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1096-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download