6234725074d7fcb44b7d6a31340b4d3ddf139b35c9824b4b6e92a85484c96a96

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edgetouch.png
Size

16KB
MD5

0a80ea3aadbf8474c175642ec4ca27df
SHA1

95d475d95545d0938f3628338f6501e3ea00833b
SHA256

fee88bd109c45a32a22510ddcce83f9c52a2358e76208599ef8f90fc22b4a633
SHA512

406f6897f47aa8eaf62372cf989fc9a9b781bf0825d1a3ae78f70fb205d79da826d00fb8b8fa9de6d431398e360b6236ad9f064ae1d3d90d1389a588abc0bf2f
SSDEEP

384:p+YWbUEZJKM5Qtx1Rq1WADf6RIlM97tBhVp9Vp88hZ+0:I1d4rj1RS4f7LpuwB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\edgetouch.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2344-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download