a85d22ccaf9cd7d27836ebaebe0bee61e5acd02356a83cf19d03d47e560fef5e | Triage

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Preview.jpg
Size

614KB
MD5

ebe6a8519f6dbd5c8ed8996182377dfc
SHA1

51ae6ca91c5e5627c143a07de9b67039ad5ed50f
SHA256

3dfd731a44c9ac4439afae86c765d3b382846c0d83e6c286a0066feda00d7724
SHA512

c33b57fd2cddc90382eef929ab0a4241980ff60797ad62405f90e157c5712b162a122a05d895716b26a5962a1bffca558205a0e22e0163fe055031d77e7d90ba
SSDEEP

12288:FHIOpPS6+4Xv1idVFJ/xWDLSuXDRZcPOnBDk+BYYv3Aldpz1j31t:FH7a6X4FJ/xWaWDTc2nBbpQljz5D

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Preview.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-54-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1716-55-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download