97407f534fdc551ed2b568c7bf7b6df69c984fda5c03c518499fee4af7f6bbc2 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/06/2023, 02:26

Sharing

Report Analysis Logs

General

Target

image_icon_constructor_encrypted.png
Size

32B
MD5

a198e2710fe94373e0d690528fdd06b1
SHA1

1b457ec4bf47c399eff699e3f3866c310c24ca29
SHA256

4177126d527243d5bed5df0be87592f29b56fd170338671e571e0d2b291997ec
SHA512

852c884bf17429f52ff0ace53c41d8b8438aacee2b9f04b317af8e2746ffd9ed7c0d482a54570e53bd2ca4b5786179c15cbb4c1d4756b6cfd70573d3e5c1d459

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1532	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image_icon_constructor_encrypted.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-54-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/1532-55-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download