13b4486d76bd1fcff0f7e2db40a0442a43c263a9d3c959a6ed7e27483ff4f246

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DesktopBackground/2.jpg
Size

117KB
MD5

0378c2580c77fa188549c2c0d335b812
SHA1

2ef150d64bfda063135d3fdd775f3e422e191972
SHA256

60761f09d8d2cc3e42cc791250d26e7014d093f6b64fb3433c803df7ca178e38
SHA512

87206a8f7eef97e025b8950ca0c3ad68794364cd07027f32d9c4a33e1001f6aae1ac75e3324d12c7776ce0bb712875d7ec9661f6a5f342b76965da9e921c1973
SSDEEP

3072:EibxxusPCfXhkBm8qJQTpOF/9d35yqQ0P8Rwr0yh:Vbx0sPCfXOBpVe9J4qQ0P8Rwx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\DesktopBackground\2.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2000-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download