c9a76d6c0da18f481125ed63a75b24f123690952c2f759e74be902d833aad28c

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:22

Target

RQ3W3185FSZY.jpg
Size

516KB
MD5

b4f1a118b060da28f258009a4a46dcb9
SHA1

9dbdf16d8c084e20c45b823928c44122af8a2143
SHA256

51fb77d542df7e1dcc8195849998bd454d8d1edddf11412937be6b5062ec8ade
SHA512

ba2fc882c129543badbc78066d05274b43c026979d964235b08b4d5581b75484668d7feafd449c8a3f664762bffc9e01987d877efb5b45d5600d2efbbbce2472
SSDEEP

12288:vCU00RJ6sBBDd95fZ83CXiClXIQzsyZEJ6K/K01mQSa:aU00zBBxzm3Cf4QztKbkq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid	Process
3024	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\RQ3W3185FSZY.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:3024

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3024-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/3024-1-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download