737c8aa1e9a435f9a4041a3132ed01595139f5c1cdeff1bc3d3b0ea7b2035aa8

Analysis

max time kernel
1800s
max time network
1820s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boredape/assets/logo.png
Size

1.0MB
MD5

8aa16f55f89daf71ce82ea556f2c2f28
SHA1

b03a8182f8939f0d8c03fab56f093e82305a2d1a
SHA256

53bb189d8e34b154a11e3096d1327073be233708d9f64799e0e0f2e92618a8e2
SHA512

32a767dcabe297aa6617e62302ecfaab7d247bca819a0d8f0550e688baab2c31fc8b5df5b2228b4406301cb6e705b67c2da2a5977df9cbbc29fdff1c1333f0e6
SSDEEP

24576:OuWCkWqtYVMDY+bBddkMkDwTmKo9LgM8siAGC+G3y4iuWdJ:ZdDqtxDpmMTwy7jC+Hd3T

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\boredape\assets\logo.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/2816-1-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download