e3596428cd648a2b0374346a990e71cf4af0feb6bb6ec51d8ec3e369f26e2bbe

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-02-2024 17:46

Target

geode/resources/geode.loader/mdFontMono-uhd.png
Size

50KB
MD5

2700f410e5f441a5da1532bc64d56a38
SHA1

2e605ca2be13a20dbb09aee982e70076b2d7affd
SHA256

4736b83bedce083a6937cc94f8e0b5ed19e6d6f6db9180f4905060c288fa9c39
SHA512

7782c894f96521d21b62c52122cf8d546295d170afde55bf23672bf047df89b487f67a59ea2fdc0232c6c6f2ce668031f93086ebe7712b623224969afeb41ec0
SSDEEP

1536:xru/J7dD7B5+9Fc2ZHJ8lbRyK22M0EC6mbVwa4:AdD7B5kOY8pRyX0gmbKl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2792 rundll32.exe

pid	process
2792	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\geode\resources\geode.loader\mdFontMono-uhd.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2792

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2792-0-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2792-1-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download