49120084b513287ae224f654854a88ed3a8bff124efa63d57db3f81d16adb846

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:21

Target

$PLUGINSDIR/modern-header.bmp
Size

9KB
MD5

940c56737bf9bb69ce7a31c623d4e87a
SHA1

f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA256

766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
SHA512

81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP

192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2472 rundll32.exe

pid	process
2472	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-header.bmp
1⤵
- Suspicious use of FindShellTrayWindow
PID:2472

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2472-0-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download
memory/2472-1-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download