51d03aad9e9f8ef2282daa338adc42d8ad0ae2ef67c09bfe384170901c869c36

Analysis

max time kernel
22s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/05/2023, 14:46

Target

Setup.bmp
Size

777KB
MD5

368f0a916240898cc18d8291643b454a
SHA1

a7875dbf874e953e7b57e3818f924721d24bd4c9
SHA256

1d6478f6da9de299e694bc76a460bfc143b8ceadf2ae1c2eab8531b48f431c06
SHA512

6679a89a00def240c867252a6685ad57e0d05e5ea257dd311ad40e1ef51ee100f7d69836e2cfc6cf2fa69d43ed6a0f514e67298b9e0b3be3786d0130d40ef8c4
SSDEEP

3072:iABE+Glkx2zJVwXWpeXjTo4k/gIWLbj/Z2kl/pYQO2APb2syir20X0nrSt/k+31f:bS+GCeVwEeny/bWHTZYQ225ir29OsLJo

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Setup.bmp
1⤵
- Suspicious use of FindShellTrayWindow
PID:1860

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1860-54-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/1860-55-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download