a2eadbd07f67fad62e31fcdf667de540468991efd621d4bd32600d2afc3fc80d | Triage

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-07-2023 20:16

Sharing

Report Analysis Logs

General

Target

Linda.oneslager.jpg
Size

121KB
MD5

420b06d401a37d34480eae07857e28da
SHA1

dd71de523cdde2162e2e29f39dc134ae7b60c28c
SHA256

acc173964ebecdfca03d8cbe07086617b1d27b7c64bc1e70e9e17e6c02c131a7
SHA512

13a619e1789ccd79b4d8c33bdc984e57f53c761e4221c80ebdec50830cce8e30eb0d1afca8cead831822d35c61d26129b73cf61afb094aef8fb281140ded0fa0
SSDEEP

3072:6C+HlVKAvIRbvciNhAlPLTozbVx+/8HOk6mfIla48:f+FFvIRLqTwbVx+r+Ih8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Linda.oneslager.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-54-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2396-55-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download