ba83b8bb4234d477f5bcb33a26ce1fca131b721ae2fc61834cc2c63ebf8fc412

Analysis

max time kernel
151s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 22:25

Target

Filmora9/Effect/opencl/Merge/Woven4_3.jpg
Size

310KB
MD5

55d8b6cecc6ebc80c42a94a14613c135
SHA1

08ef7f55666145d36f62d75643d27a5ab6b1b22d
SHA256

71a580d4bbb221221d0c9b00f1c95f78619603e6a5d0ba8a03a64ad21849358e
SHA512

196033a2479c9b946a3915974fb593199f6e1af6c9fcea2a61cf81e1b63f0038c49b73a3d1a195ef908588860cf725fddc99569a03604b3045df775df222d3d3
SSDEEP

6144:oPckcgN8FJX0AVpl872TDWrQb+ZTM+d59p2PrJIVcC9gjm:oPcXn0AVn871rQKZT9npErWVO6

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1448 rundll32.exe

pid	process
1448	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Filmora9\Effect\opencl\Merge\Woven4_3.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1448

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1448-54-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1448-55-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download