4137a6c4bea0047b77186ccd46c573f02c3f6af2f956f5408f6754c4de31afb8 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 21:45

Sharing

Report Analysis Logs

General

Target

skins/189a6409477ec6b1.png
Size

261B
MD5

66c02f15f67244cb6ac91076547e5a7b
SHA1

4d35f0324b8afddd1ba9681d84e36164b6441e17
SHA256

632a71a8e611d141d12c9e2f6b41413ee2e3cbf48b5c8ca40cf496fbcf58ccfd
SHA512

138e3dcd8d2200574f0dc57cd5c33b8ed0158ba5ab1491d6622d5cba16141df26fd42278cda3bd957dea43126af702cd56011e258420811a35f63f72b0a1ddd4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\skins\189a6409477ec6b1.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-54-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/1804-55-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download