6301e422f164b589d8a67aa7d69c46e9de3493c5684f7beb0b9c56366b89d3bd

Resubmissions

15/05/2023, 23:03

230515-21xbaaae68 5

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/05/2023, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d3ce847f17874b0b6676df0b8cfa1067.png
Size

57KB
MD5

593171f6d0506e0761c734383e382fb1
SHA1

3213f30a67ee0b0995d26ae64c9e05a24cd71c78
SHA256

88204169ae76372f880afd6f8b484af3c65ef3eef71ad859a926d1d25769aad9
SHA512

8f3b9beec5fd130495faaff2d135c0c400ae6842871bcf27c98f2c2199746cdccc52dfec02d4e1a903b9ea0f1ee9a293310a8f67a70c60fc4ceb656e5c15b06d
SSDEEP

1536:Fyg4GTEWdg+fN+sD2K+0TQhVefLA9OQk9u:Mg4GTVgbsqKxg4s9f9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\d3ce847f17874b0b6676df0b8cfa1067.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/2016-55-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download