95c09aa4daff553e76243296a9c284dac76359990ff1efc5b31a836f2f67b203

Resubmissions

22/05/2023, 20:12

230522-yzat4scd46 6

22/05/2023, 20:11

230522-yyr21adb9t 3

Analysis

max time kernel
1596s
max time network
1599s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/05/2023, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wallpaper.jpg
Size

61KB
MD5

6a6f8fa2a76f035268c27613370388dd
SHA1

8e1603b05b6d114700549040401282a06c69c0a6
SHA256

95c09aa4daff553e76243296a9c284dac76359990ff1efc5b31a836f2f67b203
SHA512

f3cae5d9582fee765f89ccafa4de3a8009baaea5df9b4c50bcf04996e3b07f3a5e3a25a58a5150d833fa7e1094d74760e8ec0c7180c30a5337dbd52972b5a3a9
SSDEEP

1536:WjJ+/BjLAZ24Xg8GRxWqUDsTi6sK+3TDafMv:WjeBR4Q8Mg3v

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1468	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\wallpaper.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-54-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1468-55-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download