ab0ff08b4586ad1cc0a4290ccbe2092345b073afbbd3775b89e549de3802f1ad

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image_2023-10-21_194146663.png
Size

79KB
MD5

fe9e737be23a9cde90a099cfaa478ca4
SHA1

89b49482f6dd4b13914a3eab5568eab4de6eaf23
SHA256

ab0ff08b4586ad1cc0a4290ccbe2092345b073afbbd3775b89e549de3802f1ad
SHA512

40187e166e5b43284ebbe266e898487f7877ac4548323135cffce5bd3d2f528641a1c3bb8477d85b0e695ee3a0639a354d1fd97a22a3e210bbdafdd97814d192
SSDEEP

1536:mwoepQQ9dYn0U1ciFmJRLF3ATEW09bCCR351ZPyzCTab7ESmZYi6:mZadC0SEJRpbW0ECRfZcPkSe6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
684	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image_2023-10-21_194146663.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1212,i,5743159587856337044,3965784811564408641,131072 /prefetch:2
1⤵
PID:864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=3216 --field-trial-handle=1212,i,5743159587856337044,3965784811564408641,131072 /prefetch:1
1⤵
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3472 --field-trial-handle=1212,i,5743159587856337044,3965784811564408641,131072 /prefetch:8
1⤵
PID:1468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3364 --field-trial-handle=1212,i,5743159587856337044,3965784811564408641,131072 /prefetch:8
1⤵
PID:612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=4044 --field-trial-handle=1212,i,5743159587856337044,3965784811564408641,131072 /prefetch:1
1⤵
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=2628 --field-trial-handle=1212,i,5743159587856337044,3965784811564408641,131072 /prefetch:1
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/684-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download