2a47f3173506bcd71bf2d7498311f60d8411ba21581e619e3304ccd49f5dc9a5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 03:03

Target

pack_icon.png
Size

161KB
MD5

64f4e1fadfad52566e98c6598362af37
SHA1

70868dd0bfa8f3a3409893280ac7d768044d4b09
SHA256

c7c40eb46fa4c6c9df8308fe2dd1b4f2e69bb51d032ab1d8a0baed6b95008c1e
SHA512

9d3f75e59b9f4d8311fe5a9e680b1209f0a370cc9d37fc11b9a1943f16e2b626ebffcca900ef4549b82f5acb549f36a196a1cd9bd8dedf0d0d0c7737f32d05e4
SSDEEP

3072:TwCHXhiJiKoVTQjx77RMzyG/4s0a5fxVtk5sknQAlP3tSO:TwC3kJiVTc79C1/4y5fm5skQUAO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\pack_icon.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2896

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2896-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2896-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download