cd4e3dc246c5f672774bc9aef7afe411a46ed6e84f018d0fd1ebe93df31227e8

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 22:00

Target

kml-bumblebee/images/logo128.png
Size

4KB
MD5

ef99f1ce4c1693a0dde37ed71b110920
SHA1

c4c77d965fb711e5a1fd60d897a14df1736c3343
SHA256

443335fd75b2bb7bfe1c2542122224ec5b734056b4230532518ed8bf7b8429fb
SHA512

9d15428d6e8dfd8a76a3d15f9d3b06aa1f0a1c6cc3cd213d7c15d763dec70d441fb6ace851d89e6181dd773f80b6935b7dd721d4bd8537f5579a2796fc8dbaa8
SSDEEP

96:cuiLa6hmhRNpXPEGiy5NKgz1NFu+Ha91AITMOhYXItcbh2DoF:cuQ3mhRTXsGZvzJa1h/9ybhqw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\kml-bumblebee\images\logo128.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1768

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1768-54-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/1768-55-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download