798b9999b706eb8240655287d18f6a0b6d1651bba28c33ead722166319d2f6cb

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screen.png
Size

118KB
MD5

aaf0070b6b8a593397193e7312680765
SHA1

386e157bb143ebc180eb5d1f57a8f9d8d9548899
SHA256

7ce02cf11fb2c70bda8655e8653481ec4d3d1c97fba581701778cf3f85461f56
SHA512

fd7ffa80a7fcbbf970848d59af0c0cf152982e79d685ebc922b5769226479fe467b81eb54676b7821c655b5914048bf6135804c6f4ea602f34f47d1aebcdfb0f
SSDEEP

3072:mfTh8+CzrNrmnalCizE4OgfqBDgrZ2g7UPqvzH:wTh8+CzJrmnalCo36BGH7UqvD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
628	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Screen.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-0-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/628-1-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download