69f1f5acffae5cdf075d9b9f4004bb5c70e80bfd68a3ea4597a24b96272158a0 | Triage

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/02/2023, 13:03

Sharing

Report Analysis Logs

General

Target

assets/characters/amuleto/a_p.jpg
Size

1KB
MD5

31395d5d4bd5eb12bc8fc47b08546456
SHA1

6539d0a2b6ae601c3176190b23b63907f22ad6f7
SHA256

3ad9ac163cc4bf0367ee04add99f15d5d680c01ec4f756879bce0949b178a0dc
SHA512

fc592cb75745304654fb6089cfa91ceafd52d01c58e72b8165400f81ea5adea1892a2b24ba47b2b673fcd59016c55eb5da1e29cc5bb45b0e9dc148bfceb1f3cf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\assets\characters\amuleto\a_p.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download