3be19c0573412ad389e2539052171d2123289dafd2bb0e5e1653656370527513 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 08:30

Sharing

Report Analysis Logs

General

Target

Handle2_diff.png
Size

290KB
MD5

5cbdee853f2ada3e335ec8208d75f2b0
SHA1

13c1f2cf0117ca87def016e57e012db67ee53920
SHA256

3be19c0573412ad389e2539052171d2123289dafd2bb0e5e1653656370527513
SHA512

3d62f47ac928557cdd8dee13f88e700083545fdb0c28a35e32e0f45ed242745064fc07a343a057bc5eaf834c15057066e297d15cbbed5930bdc6bfc668cb00a0
SSDEEP

6144:oDYEH1267ralQA+JShejYTVooDpKBgGyy99AdoHCfiMe3C/ltDD:4YEVNr8QA+0RTeoDgBnvAdoi5HdJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
820	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Handle2_diff.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-54-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/820-55-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download