560b03c4ba18e5a443f74a69727db0eabac6f455bb836757d620cc51615a92ea | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-02-2024 21:01

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/installerHeaderico.ico
Size

149KB
MD5

af5a51fc5d3cf1861f2a470711355265
SHA1

bb6ef7a49986f46b1347f007a327b7b35d28e4c3
SHA256

70e7e734171c8c32bcfe8967bb3d91fbe259952ec9c92b6562095614ff465a1b
SHA512

c3de8de1db9177521e87cb099a15ab4897e5d3a9b8b4086a555689743d9945fc23bc5c9a2409f26b2d120031e355ec6949ead3017c3b44cff7b701ad72073b8b
SSDEEP

3072:3Er1D2Sm4AA12U0ZvFJV2Naz+53/7rIQWd:3EBD1mNA12FZvFJ9QWd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2548 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installerHeaderico.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download