6c526b56946f1159ddf58f72542a3020e4610f9e70ea59bb1b30c8630a3faf79

Analysis

max time kernel
1594s
max time network
1597s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-03-2023 21:42

Target

avatar.jpg
Size

8KB
MD5

f70b24dfe9e49b0af3513dfbd53cadaa
SHA1

666a52fa433181c74463a4a07fc3b14225a1351e
SHA256

6c526b56946f1159ddf58f72542a3020e4610f9e70ea59bb1b30c8630a3faf79
SHA512

3439302faa2d0d8f7e8584fd630a8816205ea04e9fce0effab1617c71ae7590c08ae69676fc1647c3ce95eb5dafc3ed8ad1e82e607b82fda4d2b9ee65f67c2b4
SSDEEP

192:u7SVdhw9DmrAoPnQ7zads8eTVn24O2yyCfkC4VxzgGOJylq84BMqMOM51vUn1uPM:O9DObPn6Gdszpn2UyxEdkjBMSu8IPM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1492 rundll32.exe

pid	process
1492	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\avatar.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1492

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1492-54-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/1492-55-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download