4137a6c4bea0047b77186ccd46c573f02c3f6af2f956f5408f6754c4de31afb8 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 21:45

Sharing

Report Analysis Logs

General

Target

skins/09c83eb3eafad0ba.png
Size

961B
MD5

1ecc78d4cda14894b4e3afdab8f15081
SHA1

dd734f5a2920e61cf321b8f840e517e7004d250f
SHA256

65f400fde156b0212666d2ca5fd3d5385916fa6c5505145acd594e82ae4d46c7
SHA512

06de67eb15d9319ed8e417804ad895df948b45a8f279ab1848735d818815f35780312a69b40a0482371c4ecc718d65fc7be6c766b64f969016609efcdcd1bd1f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\skins\09c83eb3eafad0ba.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-54-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2028-55-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download