07528a336a55d5fc37f7add62ee8c61d205644808769a07601d6f54ac99dad4d | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 04:56

Sharing

Report Analysis Logs

General

Target

image003.png
Size

7KB
MD5

607903095bbba5c94b4aa4bd9d862088
SHA1

c47380cda6c6958bd181146bb71ee99a0fa0ab40
SHA256

d1067a71fd2e72195a688bcd9dc10278b037367d1a0e6ad117aed48b8491b3c0
SHA512

39c1cf4658bd15444a073cf0fd7daccea9ba51d15cc058b5194bbeb709083f828a49d033ca3306a8707e2b07633fa8489d1d6b54b9df012b1b7949c66f4716bb
SSDEEP

192:DH4U8ObOxB+oACrJ1fACSSp6dr7zoYoXzae:58qOxB+jCrJoSYr78Z+e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1932 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image003.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1932

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/1932-55-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download