20052d3644d117bfc87643e04ac608225386953e43a2262db84c52105df11021 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-05-2023 22:21

Sharing

Report Analysis Logs

General

Target

dfk1.png
Size

44KB
MD5

5923d4c977620eb910695f1ed1f4d0b8
SHA1

97dc1178d164758154c0421ce78fc7f779eea3c1
SHA256

9a2aaee76ba7f85e01915bb28625a04a1960eb29691e2bb4743869be13ae28fd
SHA512

8557309eea1a49b9cee3a36d8e53e1ef26254673d73a7e6cf287996a41d92ff9e77be845c513c50e53f40685e8a5d35f2f336308cd6efe00fdc25bc9127b6959
SSDEEP

768:ToqPm2iI+m8Fu/v6aW0r9BHGu6DtqxNJjsnvrNgnhiYZQI111111H:MqO2qmaUFr95upqZwnTSgu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2012	rundll32.exe
2012	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\dfk1.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download