2d9af045c4b486811a5c7247b9cbe9156829f83e439b4aa2997c58ffc3a4f919

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0/texgen_2.png
Size

587KB
MD5

271c94d5e6a6e983bdd84620eada60c2
SHA1

de2af7fe48ea1291ae2e47a49c8f75d71a414433
SHA256

778ab93c6db05f6eb3a98de63ecbb1cca0cd9d7c3ab62a6699663c857763d5b0
SHA512

f277f4ac43c1bd109587238113ce638ad7fd5dea7a55cdb889706c5d82abb2898add31d14e5bcf34bba671b3a0b89ae65796c47e3f9489c32af34506bca8904d
SSDEEP

12288:u4JZz69N2J/SHPhXhUPsWajBqLmRC+8q2eYgBUi1gWSiLW:u4z29NlthLdBIkGKJgrD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
240	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\0\texgen_2.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/240-1-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download