3408f97e869f8c68183704a186658b9d4f89e821fc50a8e73db00b5a1050273e | Triage

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-05-2023 20:56

Sharing

Report Analysis Logs

General

Target

aaak8n4d3la4vobllbvbb9rativxgunqvec.jpg
Size

279B
MD5

f4f6e72c5e9ce0ec278cb0d756729342
SHA1

c8cd336cd8d4ec7ef9c62e3f85de5de6d48ba29a
SHA256

3408f97e869f8c68183704a186658b9d4f89e821fc50a8e73db00b5a1050273e
SHA512

3273ef07d561175c12126e75ec36a251be6141664b136640ccd92ed3c021acc8957b8ad96008aeb8f3dc468cbfe054a4ab5cb3f360a0898102829dff233c546c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1244 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\aaak8n4d3la4vobllbvbb9rativxgunqvec.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1244

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-54-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/1244-55-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download