ba83b8bb4234d477f5bcb33a26ce1fca131b721ae2fc61834cc2c63ebf8fc412

Analysis

max time kernel
17s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 22:25

Target

Filmora9/Effect/opencl/Merge/Woven16_9.jpg
Size

394KB
MD5

efb8d2b0813da86b75d25d98be6c0d74
SHA1

5cb512f86c220a884baa716ebd5cce3f1008d7ca
SHA256

74c68ef5a1808ae6f95df0af2c9dd0c0d6b5407e42434fded66817182d3d610d
SHA512

90111c276b3ad849a0986fc5bfc20219de493c452a8eb8d4950fa6246727e7d62e2def19d0f7f256aa2b3315ddcb500c81c2e90a1f9ebaf082d7ded367459358
SSDEEP

12288:BhYDhmPFColObX3I04snJ1H1PNqSPtjhe0mG/8h:BhYDhzbo01nJ1HHzPtjRmth

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1528 rundll32.exe

pid	process
1528	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Filmora9\Effect\opencl\Merge\Woven16_9.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1528

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1528-54-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/1528-55-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download