7d47a48cf6aa0f78edc6fb4e595cb49dd372a5997aee15156b38fe3ad126e962

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/03/2023, 01:15

Target

prepolice/capaciousness.jpg
Size

6KB
MD5

40d98ac7b3b8b889b11d087492718eb7
SHA1

d5f3429693c3ddfbea795517616c1b67fa41d6e7
SHA256

3ed9c6547fb4ba19c9930e9fbf0447f05764d3f648c1d0448c8a40a6b1904c05
SHA512

032fa235b52218f35ff1d49d1c4c8c32bf482c78c6e2e291968e4017f7991cb9e9404ce74cc8ad18a4c862d88c1dc49fadf0099400557fc67a39709fded1a7c9
SSDEEP

96:RhEErY8jqjo82EkKJblI0JLBdre8sDJj2bPXSoiFBf0DV5OHh3kNH37PCbpI4qgt:LEOqjNllI2vnw4Wnf0J5mkNXkpygFi4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1108	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\prepolice\capaciousness.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1108

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1108-54-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1108-55-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download