40dca8cc9156a448082670599d1779339738028a616b3c1047178cf0a0baa6e5

Analysis

max time kernel
837s
max time network
839s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/language-bindings/images/linking-jar.png
Size

109KB
MD5

2d3a091b65b108fcbf288ea4a6e5f981
SHA1

fc862c303b5c4eb67504b114026c3fc90ece6db0
SHA256

3a0d0f867e418eb08e911a4745685f73b87d586b1dd2e941db249761ad2beabc
SHA512

0a34a2a21ab630f8675de7be0c68e512dbcb084d6697abc87d1105a6cca9a25837a65a636ff5693773e57a0cb94b69d1685629d02e5f37fa0cfd4b581cafbe88
SSDEEP

3072:iSfl2k4tdgHb54G8ZP38o4GVr/TRA0m9fdVKWQ3VE:/lzb54G8GoF7Rw9lVKha

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\doc\language-bindings\images\linking-jar.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download