aa3e20402d5321a908fe2cab4dd4c10fefb7fb556b196e5cf271d4f09531f73f | Triage

Analysis

max time kernel
3s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/02/2023, 17:11

Sharing

Report Analysis Logs

General

Target

poster.jpg
Size

16KB
MD5

223eb53beee54c7f5c1c447979caf721
SHA1

3a5ff0949baf70e5afda9a95ba7534fb4e1ab3a1
SHA256

aa3e20402d5321a908fe2cab4dd4c10fefb7fb556b196e5cf271d4f09531f73f
SHA512

53b0cbbaea41643223644007414b6ca2fd46dbb137ac4184f9082e96c61e9c5780f99a3017be7b8580b5e9c2bc7f8bef451cf799955e01eae9bb6052572dada2
SSDEEP

384:ZoTdAjBtikPZqodWb9BIhsjt55SXqbdOV3FZZ:ZooiAZqodG9yo55S6BgZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\poster.jpg
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-54-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp

Filesize
8KB

Download