4137a6c4bea0047b77186ccd46c573f02c3f6af2f956f5408f6754c4de31afb8 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 21:45

Sharing

Report Analysis Logs

General

Target

skins/0c3c3596460a44d2.png
Size

610B
MD5

e61d77f12a0c975a84192098abc54362
SHA1

77224072f2d8149e577ca6738e68d6981970a521
SHA256

3da6546684ff442c66db67f391c17683dea609daa1613d7e381c3ca049f9edb8
SHA512

7efaa19ceead4ad439b5fb63fa28708784661b7041d9112d8e396ddff2fee61cf4b0df23d3de4099c162ab5d13aa66d2213b2338a70e66a14e3f09e97df2b0ad

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\skins\0c3c3596460a44d2.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2000-55-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download