Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 21:52

General

  • Target

    geode/resources/geode.loader/BlankSheet.png

  • Size

    237KB

  • MD5

    99b461bdf0f532ba4f1f9510be26c1dc

  • SHA1

    e167b05e8fef6a03bd587d2e30b5316185e5c143

  • SHA256

    c0fa09937a8881914b84cb71f699b8931628ded6bdca191a25b75d81db3f66f4

  • SHA512

    debc4ce7934c54533254bf7a02e3f5a5c08bbeeac2d5256745ea1611a37638ac57ee2eef1326d5e707eff4d99a4d046a92716728e87e1bd2af52ce1f3924f524

  • SSDEEP

    6144:JJfLIDayvLuYU1nEPuclCVxMDmzoauS5FP1EHhVvhak1Mh:JJfEuYU5EPlkwmzD5MhVIyMh

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\geode\resources\geode.loader\BlankSheet.png
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1372-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/1372-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB