f5128e0f58070f9a6c6f6fb10bb80ccfaeaae755b451731027cc3eaab9a5bb42

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OPP/BoneUpperLeg.png
Size

246B
MD5

69f17d604622f150f82f8686e7c35a61
SHA1

e60f9853dae05d6bbea08e85504627bc30aa6967
SHA256

fb006c3af9d35739193228fa1fc2866c161f8f86a779aeedbeadf92995cfae6d
SHA512

e3ce2cb2873a1e223b9ea17278fda337ba7ca61efaecff82e008abcda0b0888d69dc833f5dbe8db2064530c5c9288e94332e1240aec3b25cad736031997d1cd9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\OPP\BoneUpperLeg.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/1924-1-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download