59e0d15fcdf92551a204c7e71776a88f54ea9df74e2ba2cfb04e7582c04dec81 | Triage

Analysis

max time kernel
30s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-05-2023 06:48

Sharing

Report Analysis Logs

General

Target

Hoic/buttons2/buttons/add3.png
Size

3KB
MD5

ae39f32971ba9b649e1e817c2cf61e8e
SHA1

a860f46276b61a7ab2a045c80ffea5794aac2eba
SHA256

a92e7c8347ee769a0a3d69866a7925c79e2ac885d14116dd882223b6d752572a
SHA512

08975a8a9a407dcd4c8dd2324bd9f562ee8e73cdcfc8cd8217a661e81eb57b1a7d7e8b9b66227670f1c5d4957f1151c56438aefe46c6b602c4c80f047eb8ae06

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Hoic\buttons2\buttons\add3.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-54-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1956-55-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download