210c1d51d36eb03393951dc4635282e333ddbe6caf25ae4070b5c3a598ab8c47

Resubmissions

10/10/2023, 20:33

231010-zca22abe98 1

10/10/2023, 18:49

231010-xgmwaahh45 1

10/10/2023, 18:49

231010-xgejxafh2t 3

10/10/2023, 18:09

231010-wrj2pshd64 1

Analysis

max time kernel
358s
max time network
363s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c1xsm.jpg
Size

67KB
MD5

6234a054bc10e226d821c1c2bad4a9a6
SHA1

fd851a1d35c88dd2f5d4814ba8f3637fa0013cb4
SHA256

210c1d51d36eb03393951dc4635282e333ddbe6caf25ae4070b5c3a598ab8c47
SHA512

6bdc784a5232ae445d75370689e2e9ef5983fa703d0e6466ad0591076e169826972f8b58098e25aaeddc237334ca2e14db1c4f8514ae205861d61fa272a03bd9
SSDEEP

1536:+7o7SpvyX6MYDjUnA0K/4xrOvP2ND3XC78QVJtmAH1P85qtob:co7KjMojUA5/4xE+Nba3YAHdbob

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1496	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\7c1xsm.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-0-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/1496-1-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download