5e44fa3e9e0279d36a8696c720b6b5a78e6b062ebf3b567e1240020047fa0353 | Triage

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28/06/2023, 22:32

Sharing

Report Analysis Logs

General

Target

MoeWalls/Assets/icon.png
Size

16KB
MD5

8472dfbabfdbd29ea3aed2e307cc0ef4
SHA1

f72e27a2103d287efd992b5798f40f69865fd0bd
SHA256

54610d72b6f445dc16be1a8dfe13933fc7ee8f64fa7abaf1a82669380301aa6c
SHA512

6249f5cc50c93b3fa92fa87508cb60ed5c3dfb921148479f9d7a0bee850ea159acbd3dfb159d953d6bbba41482d288bbd6bcbf0ee07dec475ff7ca8ab59a68a9
SSDEEP

384:4n1e2GH1dTQBhBuEafzzlZZtB7nysS2YANiGN2Ov:4QhH1dKuTfdZZTn8S2Ov

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1068	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\MoeWalls\Assets\icon.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-54-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1068-55-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download