97407f534fdc551ed2b568c7bf7b6df69c984fda5c03c518499fee4af7f6bbc2 | Triage

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/06/2023, 02:26

Sharing

Report Analysis Logs

General

Target

sign_verify.png
Size

80B
MD5

964960d8d0f2c3734117392e9b53cead
SHA1

3560e60f77dde2822c0819a241784456a42e34ce
SHA256

8b8da17a789f40be7489c6c5df7c2573443fd9616a18b2b52bcde4c813eff35e
SHA512

e0033e387a9d1cd194a9590c90da0dd1412c8595e4a341c55f4e92056a098840064b33b1e1d9d8dffbb4f9934ca7799aeee216cc63fb615b83c715d01f801ab3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\sign_verify.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-54-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1264-55-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download