40dca8cc9156a448082670599d1779339738028a616b3c1047178cf0a0baa6e5

Analysis

max time kernel
845s
max time network
850s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/language-bindings/images/export-jar.png
Size

198KB
MD5

586f4edcca27d0ec0b6bcdfcafa4e75f
SHA1

7c865a8e7d9c2dd77f177633a4591235977e1224
SHA256

baf9686c96aeae14f794b9906ef7c76af16f876142d710c7f8d624d1bca9503b
SHA512

fa091254e209828b78b1bf79dba1e961400598e0774787c1f31840fe8ac7271513be1a55c02e2fdbb3d602fe08d55714d53eea511699c21f9c02e462a9ac5a01
SSDEEP

6144:39l+QNvyVgQyAvL6r10GHfiJfnHMcvVGGY:3n+QJgfvLQ11HfYHMcwGY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2076	rundll32.exe
2076	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\doc\language-bindings\images\export-jar.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000001B30000-0x0000000001B31000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x0000000001B30000-0x0000000001B31000-memory.dmp

Filesize
4KB

Download