822f1a68300dce01b89812fdfe8976c355e6fcf40c89d654c0b48602b72b0ede | Triage

Analysis

max time kernel
36s
max time network
32s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 13:49

Sharing

Report Analysis Logs

General

Target

config.bin.jpg
Size

256KB
MD5

5d07d3bef9bf58abd51d987018cce106
SHA1

8d61e741d861d33a61d5637121f1ca380929ead1
SHA256

23feecddeb185d7b375378d3574132c2d0616d53f4a315887bcb4b5e7e9e13fa
SHA512

0b67bb66fe1d7ac133c14c64d832c3e8536f34ba797d1988915514d0e18731c09b13117142ef533783b69289c6e8a03ec7dc51dd97776f3b1cf0fa6e1d6ce08d
SSDEEP

6144:z8ewJTY2BRG5lqARO4qRJta8C24k1GuJ9329tRTPepjNRJ3rA9CnQAck:wz3RwOtrfCSN9Et6NRJs9Sck

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\config.bin.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-54-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1924-55-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download