4137a6c4bea0047b77186ccd46c573f02c3f6af2f956f5408f6754c4de31afb8 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 21:45

Sharing

Report Analysis Logs

General

Target

skins/030fc6bdae489357.png
Size

717B
MD5

1dda29b1ca9bfe2efaec9f8124f42717
SHA1

18216d2729b71169200598696dba86e81671ef05
SHA256

f17ed1567af54d97e903bcb8ba237e0a0cdd5c096394d71ec614c210fe6ea64c
SHA512

56a6a4c4a1e38fcd2bfdf706f73311a864f05e06f1e54abd80bde1e38d2f982adc0c8c3c0aced8d59c6c946bf1af5f1119920d6e48f25f2e52eee24d126e9b66

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\skins\030fc6bdae489357.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/832-55-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download