99ef40928c4ccdb98205c790b2049411dfac04152099a87d3fe0a6aca901495b

Analysis

max time kernel
1s
max time network
2s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 00:25

Target

Scan_20240207.jpg
Size

138KB
MD5

b71c5c74d6aebe8ae02c8d41591d3760
SHA1

38845134ca85ea8a049b3809b7a7cab2cd23b239
SHA256

99ef40928c4ccdb98205c790b2049411dfac04152099a87d3fe0a6aca901495b
SHA512

b686d9ca02e43c11c3c31599b0e34f6b3defd415e039081c7db6e1ef8635e12d27f46e0b8edcc0573b90e477b581613dbcefc3f6995623beb851b97b06fb23dd
SSDEEP

24:1Iey5aUM0XxDuLHeOWXG427DAJuLHenX3GU1qPU1qPU1qP0:1Iey5muETA4UyUyUy0

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Scan_20240207.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2088

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2088-0-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download