Analysis
-
max time kernel
116s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 21:42
Static task
static1
Behavioral task
behavioral1
Sample
nerd.png
Resource
win7-20230831-en
windows7-x64
7 signatures
1800 seconds
General
-
Target
nerd.png
-
Size
38KB
-
MD5
1d99836ff14bd059d5f214b75006a876
-
SHA1
ac19555a75e381a11aa8608dc38b18c9fb608f73
-
SHA256
d7b0bc8d4d257956ca760aa87902e81c9553013f658a3e969361b408e4baa701
-
SHA512
d170fc49087f7f78f1713f6b9e7f2c492f61ce40bf5aa4cb8e40393d7a025a3b96538e93fdf57e93cd7ca9bf78eec973d6cdf1401c2396f6e1456a41aeed4ee9
-
SSDEEP
768:KTk2xcQrQMqkW6A4htKFT/7g1aE0eyOCYwxhKwDx8uwFJZyv5dr:KTk2xQMqI7hcFhEWOuTDx5wSr
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: mstsc.exe File opened (read-only) \??\G: mstsc.exe File opened (read-only) \??\I: mstsc.exe File opened (read-only) \??\J: mstsc.exe File opened (read-only) \??\P: mstsc.exe File opened (read-only) \??\W: mstsc.exe File opened (read-only) \??\X: mstsc.exe File opened (read-only) \??\Y: mstsc.exe File opened (read-only) \??\H: mstsc.exe File opened (read-only) \??\M: mstsc.exe File opened (read-only) \??\S: mstsc.exe File opened (read-only) \??\B: mstsc.exe File opened (read-only) \??\L: mstsc.exe File opened (read-only) \??\Q: mstsc.exe File opened (read-only) \??\R: mstsc.exe File opened (read-only) \??\U: mstsc.exe File opened (read-only) \??\V: mstsc.exe File opened (read-only) \??\Z: mstsc.exe File opened (read-only) \??\E: mstsc.exe File opened (read-only) \??\K: mstsc.exe File opened (read-only) \??\N: mstsc.exe File opened (read-only) \??\O: mstsc.exe File opened (read-only) \??\T: mstsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2652 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2652 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 1724 rundll32.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 1724 rundll32.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe
Processes
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\nerd.png1⤵
- Suspicious use of FindShellTrayWindow
PID:1724
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2652
-
C:\Windows\system32\mstsc.exe"C:\Windows\system32\mstsc.exe"1⤵
- Enumerates connected drives
PID:2632
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2464
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:1900