831e6c4d7466884a0dd9000da17b1a954eb42d44efb7aff45a33d29b4c044f45 | Triage

Analysis

max time kernel
36s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 19:13

Sharing

Report Analysis Logs

General

Target

perfectly_safe.jpg
Size

299KB
MD5

f02f08dd3190eb4caf8b7bf8066c329f
SHA1

9b315f2d222c83dc7aec7d4715a5d65a2e27fe0b
SHA256

831e6c4d7466884a0dd9000da17b1a954eb42d44efb7aff45a33d29b4c044f45
SHA512

1300266f99c4112484dd11f289583ad9f45bd6a9dc3e506500060123435d4ed552ace6deb46aeb79696e71c527f3abeb4179bbcac9b5923d9da73df4442e8c37
SSDEEP

6144:AF8t1IoeNouHJQbRlQInIZiFSTZKraMzNkzuPMDckqfDXzlcWz0Rk:A/okGb6ZikdKrtNxEgBfDZnz0m

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

748 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\perfectly_safe.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:748

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download