27b0887d18811457b7e67bcbba6e11cd4f2693911efa971fe7ab254bf9e279c9

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

google_tweak.png
Size

77KB
MD5

aa6ae179b0a89be191188444195f92b2
SHA1

468be52fa31b006e322110fa944709b90dde49f0
SHA256

3ed13230fd447833986041da408241118f786676fab2495d22b5a1d38d78c180
SHA512

13486663e7700e0fc5c0318a6e9a74203321a4b2454e82edfe7cf45f391744aaedbbcf577f4b32a9e51bac084b51e624b5ad8339b0180e3d430f9c77ceea0c7a
SSDEEP

1536:W36ySEdRbpnQqUht6eBVE9Mfx5OSdl8c7bdSNj6C04GQuXO/N:5E6hIgyM6al8c/ccCVG6l

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\google_tweak.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-0-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1716-1-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download