dbae0f7347617c31c0e20743e00d2281fb60143beec123ac9de525d46389c648

Analysis

max time kernel
1561s
max time network
1566s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 20:47

Target

ul._15-ti_noemvri.jpg
Size

749KB
MD5

008a43d66a6a00e406a4235b72ac2246
SHA1

b93aa52491af2bd52cf0bf72af7e7d5c732a7dfe
SHA256

dbae0f7347617c31c0e20743e00d2281fb60143beec123ac9de525d46389c648
SHA512

c40e859f3c49cfacae78cadec26e2495e7945a0e9723ada29acafdb13c604b24b46c682560450443598ef3eaf8c52770ae4d845813e61b19e943daae087ed73e
SSDEEP

12288:PC1VfBro0fBzqyBA4Cwbu/qN0N2hNzWmMOcMmwMMXNzT/xSoGFB1U3u1TbhNE8on:PC1brv7O4u/ihpWfj2l8Eu1TbE8JDKue

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1836	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\ul._15-ti_noemvri.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1836

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1836-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1836-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download