784e55923d4ff8122b90601508d170c7e463d4be2fb0ca8fef996618f4a4776a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15e8e151fe8b0bec38925521db45278c.jpg
Size

11KB
MD5

15e8e151fe8b0bec38925521db45278c
SHA1

a74d3e652dede9a8eb911ebafa27773934ef2f2f
SHA256

784e55923d4ff8122b90601508d170c7e463d4be2fb0ca8fef996618f4a4776a
SHA512

fa0310ae725483fab519b9def7ff82f1e01dc506928f49be0f4d953bb1513b8baa2158f8769b09c04eaf45f27bb000106d92c06fc46546b47f68b195519f7f69
SSDEEP

192:ruqs3BAGRlj52UI9BCtDMUTxk1ka3uDxO3F2RDoIO4aG6KpWs9lPvCCico5SN:rOxAkPI9BCtDX+yeu1OEor4aIWs9ACi8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2456	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\15e8e151fe8b0bec38925521db45278c.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-0-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/2456-1-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download