1a5ea5d5b7497112de74e033c0d10902baa48bd450bf9dc3d13b6b6a04d3c268 | Triage

Analysis

max time kernel
55s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 14:54

Sharing

Report Analysis Logs

General

Target

logo.png
Size

18KB
MD5

ce884b387066d7ee9be75f80b3c4bbb3
SHA1

3da35b2ad919f5c5d1361cd55abff59e9daf91a5
SHA256

1a5ea5d5b7497112de74e033c0d10902baa48bd450bf9dc3d13b6b6a04d3c268
SHA512

3778505b18960e78bc34f824cdd2a782937d581fb6e0af4b541005916879d6f23471a9a3ec1b07660a1245894987ada181809c17b8c1ad5620bd42d82bc1d611
SSDEEP

384:4CLcid4QhK/dEGhYhD/cXcfKtJSsY4q00dIRa0IShYbQ8iirr3WQ2bEW:yXRdEIw0mK6QL0d/kYbQDiF2V

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\logo.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/2036-55-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download