a3807794c390acc037b4de2d88f9869406ec661946af0a9e4a06cbe1ee0ba4a5 | Triage

Analysis

max time kernel
25s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 18:56

Sharing

Report Analysis Logs

General

Target

0-0caa7.png
Size

421B
MD5

7c8a86e0344a9f84eb0c6dd9fe8a181d
SHA1

f6f3b1d49d1faca93504af64caad3a46f7d02dd9
SHA256

e3499a3f8e35cd2790fec4bae87d7508fadae50c0b3f1ad46180948403bfb961
SHA512

135f355c7fef123be73e0d6ec82f40f4ae499e41935f09087ebd2c418c802b85dac82f3ab5358120ce8240d7347ffb1a115d59df3c6df1cbd446acd855d8df42

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\0-0caa7.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-54-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1724-55-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download