f28f389ac0824bee4f8747c853e85a78c3c8ee5f07098d49a6528ab40005abe1 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22/12/2022, 16:15

Sharing

Report Analysis Logs

General

Target

semihonorSpeculated/manypliesGreenback.jpg
Size

7KB
MD5

6d3085925e4248f0e5206faefce94c51
SHA1

76c1f2d0c86155b9003a21fd4ad096fb5497515c
SHA256

986da7424801ae4284d39853dd285d4336e1a8044f5b3e1a49d69fda33742e95
SHA512

86829a4b88f4520ab4ad3bf28c229072ccdffa0a1f7f0edc6b51eb7e2855afba62c16213d82e588e954bf42407d5914622829c2e8280df27ebe964757ee03087
SSDEEP

192:LMssmkogTVc81LRfdXKkJkrbZjm2AFcBVRid:Issmk5b1FdrOKsI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1200	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\semihonorSpeculated\manypliesGreenback.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download