f5128e0f58070f9a6c6f6fb10bb80ccfaeaae755b451731027cc3eaab9a5bb42

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OPP/BoneUpper.png
Size

355B
MD5

cdc62a7e81c1b9fd4b1e22495ec79839
SHA1

f4d3d40ddee805cc22351f299952a9d1368fc252
SHA256

b648d77c50b25f058d3e0b14752fa833a05126683e2dd937fc7c22dff38f3e07
SHA512

627fd3a11890cc4044b2b361ba5661f7160ca1171046f89c8d310a44d1e0ce450c640183a25b70cb5c1d8d384f753aab6218129264a6b301c08ce0c2df558ed9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\OPP\BoneUpper.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/2940-1-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download