b625765ce751d3a56674fee9215ba69777a3e7ab37e6cbcf418c918de423c0a3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-09-2023 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

crossing_nigth_bk.png
Size

18KB
MD5

09060cab74b015ed5e135cb25d2772b8
SHA1

7f61ef164901411972a6c08e75171049415644d4
SHA256

3dce6d890a489f87ab0637c8a4172a095c09e52367398bec192b348958810af8
SHA512

1d8ea652efeaa10dcdea8f258d398d35aba97ed5da70985ffbab6fb12f5058150802f37dff24805c2388e3cbab0e77a7c152e018e8b056fe16628f304d7b60b1
SSDEEP

24:dJLYWuqylnv/pe3a0nkJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJO:d74vOl84h

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\crossing_nigth_bk.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1856-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download