665810f9858a54faf47116d9beafbc29e8d3eb1baf528ddd8d1eedf585b562e8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image001.png
Size

12KB
MD5

67fcf7ca5c2df30e6b7a597abf315fe6
SHA1

73097137a865db3ba58467eb7d5420245d09a815
SHA256

108d16104fa654ff195fdf35bbb8c2f66ace46497f8a58d0db2ab99971428b91
SHA512

ef5a0b099cff4682b1f2a233ba9d1a03862fdaca070d988509d1d74e05211ed1fbe6b2215379c468d6cab3a60b67a2039236c2803776e9c5d2a6ca512a4541a8
SSDEEP

384:EgYuqKCSH1SFs3ttLhsLDXQ6SDS/ld4Y9IBdsrf:EgYuqjSHHUEr2MEZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image001.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download