95f566ccf1c3e12866205e5f38adebb3106a3b2f11ae8b6c49b10772102588b8

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image002.png
Size

6KB
MD5

fe7396ee7505902200905d647ace36d2
SHA1

2928748ef18504b5c23b4c9e27101c5129f47974
SHA256

5c71d5da3748aa9956e4a5698abcdb6d2458229b36945b77a37d11a10c6b6702
SHA512

35bdc5eebd507dd220b830446f9e8f693519724d3c4ed4c47dc701cf14fb22242068ec01da1fd51a53864e9ac747f675d024339aa45ca56d962388bfd3f861a8
SSDEEP

192:7eoSQ5T2ND8nJmvw6e2SQQU7mrqgJkf2221:7e1SQD8nJD6ezHeKkfY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image002.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2412-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download