c751cc6e440393b8023e6140aa2f0197177a788741c385a9d85cda9ba7316227

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MCBESwitcher+/data/help-hover.ico
Size

38KB
MD5

ebe1ad9806ade15eb0a3736bfcf23137
SHA1

c1b2229f93e0a9f917e2ea6c44c2d2b088ff6fa9
SHA256

cbfd620aa2cf8a38fe36fe1b4c46e5d1dbc79f3953bebda04bea0746dab4a488
SHA512

575893cd3599abf103dea3bfdee253bc6f2baa11243478bee52f5c46b9887546ce86c9ae759b0568bd2b951b65eb7066ddd41ac1327e50608d9067dbf95593f2
SSDEEP

96:FCLrCCZ+QTVpVDjTNu6CRnuL6Q5IqT8Br54NPquZDrF:FGCCZ+QTVT38J5Q538PsnZD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\MCBESwitcher+\data\help-hover.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-54-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1616-55-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download