61859a2460b667071ecd47bb30206247afc972d6a02f5932d827057734347133

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-07-2023 11:01

Target

newhotmail/hotmail/images/hfavicon.ico
Size

16KB
MD5

12e3dac858061d088023b2bd48e2fa96
SHA1

e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
SHA256

90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
SHA512

c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
SSDEEP

24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2384 rundll32.exe

pid	process
2384	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\newhotmail\hotmail\images\hfavicon.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:2384

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2384-54-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/2384-55-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download