1dc3d2b241b864fec767ecdf1c03d022b6e21785a03e523d187aabc00492c241

Analysis

max time kernel
838s
max time network
843s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6325-src.jpg
Size

40KB
MD5

932dea96768cdc9eba08622bd695f56c
SHA1

dcb6c08b55dae58e2a2eb52529d10892ca5def2e
SHA256

1dc3d2b241b864fec767ecdf1c03d022b6e21785a03e523d187aabc00492c241
SHA512

6901596320fa1a9d77be162200a2afefbe52f46914b0a8199f7523ce8a27a81925e1f527b8a6765ce0f3d371ed83465dcd1979f82a8ec84593834bc8727e70b7
SSDEEP

768:00mruDBkoiJh/sqYyc7OWxfLZZ5P854FU21i7l1OLVnB+I8mm3ocP:00RWh/YTOQd854q21ix1Op8mm3bP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\6325-src.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/2376-1-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download