86359da3f3cb347f1979479396ea7d8096f9f52ef9e25fe8b7084a54fd7d16f0

Resubmissions

02/06/2023, 20:11

230602-yykmxseg2y 6

02/06/2023, 19:29

230602-x685taee3s 10

Analysis

max time kernel
1625s
max time network
1627s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/06/2023, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

icons8-cursor-24.png
Size

329B
MD5

ccc8ab39f8102baa9a0f9fc80e7db73f
SHA1

193aac7cc3f16fa2e9a02f271a8f0562336a24ae
SHA256

86359da3f3cb347f1979479396ea7d8096f9f52ef9e25fe8b7084a54fd7d16f0
SHA512

7388ff7724a79b4b53d0a70f0904e5ad439533556a9960597de697bd10742b672398facff776547787aa6bd423da95fe6a3737adc035e7f841fba292f95128d5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\icons8-cursor-24.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/2032-55-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download