0676d31174e16c8f42c1d2fa87adf2c5623c121aef0e28f2dba9086a9077f105

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240212_204346.jpg
Size

1.4MB
MD5

6bff8e26c7e4fbff0b9d9c98cc745f8c
SHA1

8af21d3e852f82a2486225438f6de1cc90bc4730
SHA256

99bca6ff3e7b9261b6e57a9e9bd6dc1708dcfe4a663e91f040f53da417f71639
SHA512

84094880f93d419e7aa96965b418afae31d112cf09a779263c945b4f16ed93ec41a23a48a3e5c1f16ef0d636acef846409e2418f1f4df0b6174c8b00bdfaeaaa
SSDEEP

24576:RsoWvfPYI8JSUQtNnopBOqB/MUYY7L7OJEZJUjCtS+XVHwFiEOdokh5ZdifWWiB:iRvfV8dmnoDO6YewCtDHw4D1u+9B

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\20240212_204346.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2924-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download