4137a6c4bea0047b77186ccd46c573f02c3f6af2f956f5408f6754c4de31afb8 | Triage

Analysis

max time kernel
25s
max time network
28s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 21:45

Sharing

Report Analysis Logs

General

Target

skins/1a206ad825e4c3c3.png
Size

620B
MD5

cde94b32c2fc3756d3b5931c5931b1d1
SHA1

c88ff5c176b60109a99d52f3a53232df244f0f95
SHA256

fbf3850264bd70199bd01d0f88df52e6dfa7c0f80b1c1e53ad4fc22caa9185ce
SHA512

b46b394fd689febceafc06c5633f48427ac654f5990c820e0f685961bbd84b19721f36d817531c0c1bf124ff0e20de0430b69fe9dbb9ff91283a0ca4c39e52c5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1556	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\skins\1a206ad825e4c3c3.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1556-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download