0cf2e6dbfcb476ba8752250bc15db45aae19c81296adfcb627205d61320a9720 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 19:25

Sharing

Report Analysis Logs

General

Target

images/icons/64.png
Size

3KB
MD5

7b681bc4dbb78f21d307755c4827a061
SHA1

204ab7876f8a6b9b880f6d9992e15ead13a9d3d6
SHA256

d678cc6c32eabe5781575f0d6e10abfdd0c0c4187ffaeaac72f69b51439c2a58
SHA512

23f3f8229143e1bbac6203c3ec4e94d4a52aba351fd223a54035e1f327cc15851e4d247f6f9504746daac0258461b92b87be490fe516729eaef6a4e42538b4e9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1532	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\images\icons\64.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download