b625765ce751d3a56674fee9215ba69777a3e7ab37e6cbcf418c918de423c0a3

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-09-2023 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ap.png
Size

2KB
MD5

f3a1627fe912c49ecdcd4ab92a5d6bc8
SHA1

83594f213015203ff4366f47d0df73fd6ceb875e
SHA256

c0f9ff255860cb0a73367c2dcc52676858a7e8d2bd97a1c6884a8344fc2ed699
SHA512

48f17c16fdf748f56301a17b95c95a80e387804a8a0062f344c736f8e4521ff3bc4de7e80b2d32c4d607a945459f66d698a4552cfcf8d1ca08042906e9e351d2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\ap.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2124-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download