b7e59768071d2e1fa278737c39770d2c712cc4c7c9a631c42ae06b7acd4f679a

Analysis

max time kernel
239s
max time network
290s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BE_Export_File-uhd.png
Size

16KB
MD5

cd56317843478c0364700d8efda6a782
SHA1

bdc5a8e04ab2df15b52ac0dcfcf0365838dfa620
SHA256

0e6cf19f85e7f440b4c92a54503bf919df132541cd7bc3fc3d3d0ac284213cd7
SHA512

4f08a3be3f544381ac97d61c7f5d73765bb27c9788aca7d2206e6abc18b1c4582b18a125fb0467c2d2ceb2f1f9c79f55a8a4420675fb715ef2b2fa957b5a0fe8
SSDEEP

384:Z7ACfvYUW35l5arnDbrWWsgYTgCcfY0WLAlXgU8IhCoct09vDM5lpF2k:VACYUWpl5In3rWHTgK9AzNZv45lL/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\BE_Export_File-uhd.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2684-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download