6ef26a8ac83d7e17b484e7f3de0a66d5d27a32b0b48ed55517c2f6723b67d8da

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/09/2023, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

img_10.png
Size

19KB
MD5

1bbf7dbe2cb2a7fef749d6c6775f86e8
SHA1

170d5356b330801af430c2f09947db76fc679545
SHA256

fb92624c032232ee018181977bcdd28249c65c1f625f25f49348939785a1cf58
SHA512

9b1163c341bcfdba7990695f2f1898414b9b45dcdf3ec1ddcbbc5e310f0377007e4017904cd8e475adfa66b1286bdcc870fdbeb297d40293ffd29aa525733a3d
SSDEEP

384:+eIooZBfLSN8yFwhQUbeLLmqdpeHDu5+uuk1tPMARli:+p1lLSN9hq2LVejJ0EAzi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\img_10.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download