edf3b72f6e641a2b33ab557712baa7a91c94f65b8659c3a0ead1cf209210e339

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07_dcast_lineup_efe.png
Size

153KB
MD5

764a18ca5759733b991a92a8a13cb3ca
SHA1

0612ff13a68532a1d43e9cf677c81d9b8f43761e
SHA256

fbdefe7440778d0c9b6bc03363990e78998e96eab847528c7f6559a263b96a6b
SHA512

c7f0f7ac7806431dfa1dba7d5c5f7e73d3a516c9a38515dc82cd335ad5e325e6a1c61563b09eca3b34384590ee87b0c53291e92771459fa6f934f5ef397dd839
SSDEEP

3072:SD0r7iRLHuJz2auRogQpXAjOMMhjy4P0E3c10xgFBkNXSw1X2IzgK:40rNyJQpwjOMMVdtiBUCOXaK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\07_dcast_lineup_efe.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2764-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download