9667047ebb9797ede90fc36f620ded580e0ee136debb7e39900050f42f822859

Resubmissions

22/07/2023, 01:04

230722-bew6aahg6z 10

05/06/2023, 14:23

230605-rp5heaha67 3

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/06/2023, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

descarga.jpg
Size

8KB
MD5

538e4a9a8078590f191f6dbc33f7cbce
SHA1

a3b9311ecc6575f09861ae795aa56adeb42fe5c1
SHA256

9667047ebb9797ede90fc36f620ded580e0ee136debb7e39900050f42f822859
SHA512

83679412e7326b2fc1fc3942737f1b5e5115f8ddfb5e7849513990fc3f9861a3cc03917fd8547d5d3cdc67257b93f242c3ee22d55dcc2b9cefc51dfa055143a9
SSDEEP

192:F6HKTvgTrdvsjfVPMZb+1+SjtUY2YZ66tVZNkr7ra:QHKUfdvmfVPo+gVY2YZ66tJkXra

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
288	rundll32.exe
288	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\descarga.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-54-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download