4137a6c4bea0047b77186ccd46c573f02c3f6af2f956f5408f6754c4de31afb8 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 21:45

Sharing

Report Analysis Logs

General

Target

skins/151e2fc11f9d7a75.png
Size

496B
MD5

d6e29e90a84e8b9ac48c7593b1384487
SHA1

616bdf562307a207743ac5f999f16d6f0506062c
SHA256

680706e41d8b1364d60a6f84033cf331d1e029fc1fc0c90c8949c473e35caa45
SHA512

a0e290b905586f0e975cf22e448f2c483b2fd9f97747cc20387bd78de8b48d949b411668122cfc260619074151e606736e58a3495f4a2a84b52b453e83af9cb4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\skins\151e2fc11f9d7a75.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download