d3b36699e352553847cbf3c4f81dc3824c517f3dc8648d143b4a04547cecb854

Resubmissions

02-01-2024 19:59

240102-yqp8fabdej 5

02-01-2024 17:26

240102-v1ac7addb7 3

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

img.jpg
Size

294KB
MD5

b2de127f4dd40c4640bd3467cc5935b0
SHA1

af04aedca1bc8ae320f4963213a0a41c302f23c9
SHA256

2397654cbbe68dab76603837186acc86fe2d7470a0d0a9992ce64cbd73901081
SHA512

c0f5fcb12bba4c445d4c3b35fb44b3780f6ef210d8a40775fe73370097f470fb5f102fae61cbb6066717663dc807881112c292c52b379c561e51537160dd4794
SSDEEP

6144:FH8x/SdVO1WefRngf+w2+IkppHtp0hP5BdcfNHpyNVbN71JDPvtcyMs1:1C/SfYdgf+w2pepHvEP5Bd8Gx73Pvos1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1228	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\img.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-0-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/1228-1-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download