cc99aa4daa35b137e0a62e38640ef45f0070a79df2f6961ad630d863d9c695f6 | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/05/2023, 01:50

Sharing

Report Analysis Logs

General

Target

2023VNĂ-100.jpg
Size

14.6MB
MD5

f412008bb6138fee543c2023fcc7a3f7
SHA1

54848396c49bcf8ae7ea59cf4c52fd0624f3aed4
SHA256

5ad56f88e6fba814929f61e70a1dcb6817781183057567593a48d60cc42cc5e2
SHA512

4ce35ee9b19dd038e4da127475ce6c6461819eb1ea54496260dd8c17978852fde339b9f41c2ed59bfb0a37a81843ff0f078efaf8329048805985344d9bf4db9e
SSDEEP

393216:rot6dpRzt1cHpejGdIZ9Lis7D3FjgJg6fW:rotWT1ce9LL1J

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\2023VNĂ-100.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-54-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/1568-55-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download