ba83b8bb4234d477f5bcb33a26ce1fca131b721ae2fc61834cc2c63ebf8fc412

Analysis

max time kernel
64s
max time network
37s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 22:25

Target

Filmora9/Effect/Merge/LinearLight.png
Size

536KB
MD5

66748de6d302445638050eb138365514
SHA1

3d76358649269f039d99c71975b6e00f1beaefe5
SHA256

7b0e959b30942bdb8192481ebd0f6f14acaa31ee867cb26bede064a02c2015bb
SHA512

b8e5eaf7380bbf827e47adcac2a7d149b542b059cedeed0ceacba938eac9d5b2b1449a35d2f60ae7e6dba1e8b56c9c66fd7748cd7455d8a2087c8da9091b7e16
SSDEEP

12288:lNo50a7fI+78n250TPaZ2DKXbXo72wM+IyPSrxwyapZUdeQYjk/:le50a57HZ2Di47TM+IsSrxWZUdeLje

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

rundll32.exe

pid process

1628 rundll32.exe
1628 rundll32.exe

pid	process
1628	rundll32.exe
1628	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Filmora9\Effect\Merge\LinearLight.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1628

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1628-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1628-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download