97407f534fdc551ed2b568c7bf7b6df69c984fda5c03c518499fee4af7f6bbc2 | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/06/2023, 02:26

Sharing

Report Analysis Logs

General

Target

icon_max_data_encrypted_xxxyyy.png
Size

32B
MD5

55a54afc17eefd8eada00b801c504ce0
SHA1

31c3b35abf33d3e1c7451426493079a53213d384
SHA256

fce3b49152b491ea9aa81c3927de848d7be88c0829626fc2cefe2791e83596af
SHA512

b5d4aa75db35344c1f6cc0ecdde45d7f4a796aad37ab7f1039b952bac5cd9a3a281b6b6db541a03bd3984e6c7ed33e233b898a6222d87bddf01d410f41070f1b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1388	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\icon_max_data_encrypted_xxxyyy.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1388-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download