4137a6c4bea0047b77186ccd46c573f02c3f6af2f956f5408f6754c4de31afb8 | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 21:45

Sharing

Report Analysis Logs

General

Target

skins/047c58d59a5396e9.png
Size

266B
MD5

05882a75835c88a6c96575a766a6bdb6
SHA1

d69d0a90e36ce8140c0de4a268a67090a21b77d8
SHA256

72205e00f9664e7e770fb3af38a29c198b1a632abd36910853de82ccd78115fe
SHA512

5a73eca174dccd37b03cefe56d3d15ceaa62b40006f0b7e7d8f0649d0b3f98a15d6d54add4101886c6c21d68aa910068c981f6ccb76bb881c684cf91b373a30d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1136	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\skins\047c58d59a5396e9.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-54-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1136-55-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download