758c9f9c44d2c03d6f2c9621f56eb1f6cb36e8b445286b9565621afeeef9e06f | Triage

Analysis

max time kernel
21s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28/06/2023, 23:35

Sharing

Report Analysis Logs

General

Target

728EC1.png
Size

7KB
MD5

2cf9db1aba116ba212c183659d720267
SHA1

0845571a4c5f29e2c30c8e3e95d5efc8a9d5c541
SHA256

9e49ad175ecc575627cd2b1b144122688bf49d587727d841e0ab7f192d0e18a4
SHA512

e28c18d65e38a7f741fe03c93e88032dc36174f1dc67785e2c1277f67127e59754190bc6cbf33daae4e3857922904a47868f6bf68774b76f6c61c69dc89a3de6
SSDEEP

192:O5ofOVW/CeFEeXn0Bd95pddd3MTP74k2cLvT3Ey6Nr:aoav4EekdPo74L43Cr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1312	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\728EC1.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-54-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1312-55-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download