0676d31174e16c8f42c1d2fa87adf2c5623c121aef0e28f2dba9086a9077f105

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240212_204329.jpg
Size

1.7MB
MD5

bf2e0ee66baf5704b0f372945ddbc19d
SHA1

69616eeccf76e02125aca6338634457c5501c3ae
SHA256

7d0205642b62aa8d176eb44a1fc33359bdd5d22781cf4a1c3e577eb6ce40ab58
SHA512

cb6271709644a8ef541efba6a0e9957a228301124d87450eddb0c5316a7b0ba00d3ea5e9303a821e3870ef4fba4265c8ce0ce99be7a5839483b8199eae5b27fb
SSDEEP

49152:WTN7Q8Lk6W/hqKvPtf+qSvMMYuZ1Kh3yueXkfNpKvtqI:WTNNk6ChqK5NSvM8qteX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\20240212_204329.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2968-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download