7ccc89d8248cf5a36ca14d3682a42b17826dccd40e57d46ebe903158f11380a4 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 22:00

Sharing

Report Analysis Logs

General

Target

ms_com.sankuai.png
Size

4KB
MD5

6578061508d77e9177a0bb64218ec165
SHA1

53b58a8b3471694ebd68fc2c95b149db09337d0a
SHA256

6ebc77c83c109501a767773adc98cfc094e0c7354b60f0d97621f910ea5fd72c
SHA512

e96009207c1d25702d520156ac815056dbe0bb8e37f9a0ab02f12f0024a1dcf393386e4e94bc90a8591cb2546727edd27404dbb209b1288978368a356d198883
SSDEEP

96:AAzK8YReyKa2KKz9FOSM3X6rKPMDTl9cZrK0I+Z9KWIRsDWmTTG69:AA5aeZFb+PMvl9cM6IWIKDWY6c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1932 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\ms_com.sankuai.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1932

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-0-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/1932-1-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download