b2fe49377c9a18bd30d4709499d66bf3d48ff7cb146dcd7b7da6a88fec6c142f

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

img_dream_interpreter.png
Size

2KB
MD5

2e3f20bcb09569987c71814f6bef7139
SHA1

512122d55a2d5debb0861b0d8afe53aaca468ef9
SHA256

bd78bcd527b7b494ea1cc0306cc36083b7c7f7e42e83cdffa7f92ab26a73dea3
SHA512

a6b0d8284caebb07fd1c9a4992a7b87dfb5926a6c7634c78a2cd7145620346b678a3e4743d022af1868617c799343a488506994a47d17232cdffb0801c0612fd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\img_dream_interpreter.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-0-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download
memory/2576-1-0x0000000001C20000-0x0000000001C21000-memory.dmp

Filesize
4KB

Download