8fb5890f75d501936e90d1891cd97c8b23396525842fd741f9b9a441405cd01f

Resubmissions

26-02-2024 18:15

240226-wv4khsdb8t 3

26-02-2024 18:01

26-02-2024 17:58

26-02-2024 17:47

26-02-2024 17:30

26-02-2024 17:25

26-02-2024 17:07

26-02-2024 16:42

Analysis

max time kernel
1563s
max time network
1569s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-02-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gato.jpg
Size

54KB
MD5

cd869039e351b02dde534759ae627caa
SHA1

8c227c8532a3106c82009117500a53fceb8adcda
SHA256

8fb5890f75d501936e90d1891cd97c8b23396525842fd741f9b9a441405cd01f
SHA512

81a5b30497bb3cf7b6257728ef5f04b2e45d1ec23e159035210292b13514a82313e19c68878f50bd10a9382ed5b6a83c6356d2d2c0607a79ec2e8afbc9bc3fc0
SSDEEP

1536:g6taN+v7AZswe0Q4qKjLkvqwWsXcWQeldDrVh5Bh0K4:QEAneazLaMWQWdDJh5vI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\gato.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download