76faadb7a67b688f58951c537fa98d0f3cbc77ed01fa3fb18d16146d36b7a06b | Triage

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/05/2023, 03:17

Sharing

Report Analysis Logs

General

Target

embed/embedding0-Extended.png
Size

6KB
MD5

dbfbbb5cb285f798f8fb01664ddb03ac
SHA1

c3d8352d1020ca88978d0e9f96addacd6c8048b6
SHA256

6abca1e4568e33dd0b3f7d9b695692365338a5527d62e2c56833b96b26a9a105
SHA512

b139ec7917a88167972c4ae8e28b9bf2539ad22950cf05f0a9151cab28c9a2847d353aec3f571c5bcaacfd05853c7768df2afa9b8eaa648ae993011f42581885
SSDEEP

192:doG+wlXCuENx2/I3O2T+Z1SsOXOzBfXy6F0wKKV9EtT:dVNlXCucxCQTC1SRXOJi6FqQWtT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\embed\embedding0-Extended.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/1220-55-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download