cf2103c5424c88a3294b44eed928ac29b9fd5f3fd8f1ee2b310f099df4488bd4

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 18:30

Target

newsletter.png
Size

34KB
MD5

8d0418f62008ad5fad19779902aca7ce
SHA1

45c51ef73455dd3eba3a7529e175f846a58b3de1
SHA256

30b9bfcab3bb0e0ab3f2790ee5f858a0ed608cd846da9bcff732fb74884a7265
SHA512

d57467b53f7d3bc1fc69646f04e439d26638aa62f2591ccfa30d6c09bf7d6fbd30c732f0459605878a1277c001958cb3be2b335876cb9db76ba0a2054db7f9dd
SSDEEP

384:jz61PTSvZ7IIPHfXdqO2vxLk80l4hEXzFKIr0MOyVUqn0Lygg/N0vFGrJCMyX5/H:P61EZ0EH/dT2Klb5KI7acIANBFS/H

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\newsletter.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1728

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1728-54-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1728-55-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download