d830ec3b172c3b551868cbbf48b5ed9c275602fa422d22d8676dc13a9aaf0651

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hair_20200922.jpg
Size

2.0MB
MD5

8999d7dfe8a0e424b1f918762a1ce67c
SHA1

8a4f765d681bbfed63cb590c4f0d51fe78affe5b
SHA256

d830ec3b172c3b551868cbbf48b5ed9c275602fa422d22d8676dc13a9aaf0651
SHA512

d0bc0565a9b388926e63f804f31f4bc79dfb2c1095c3a3b440a956ff7885aab7543f7dc16bfa864637e6d7a1b5a93cd5f7e1c089e7e4e421cc36f0be4eb815fd
SSDEEP

49152:+pskD5MNsjozIFhJBwN2BNT8Ag41zFMhlNbi6:+iwcS6NINrgoKls6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Hair_20200922.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2144-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download