ad14e89636f8603ee56438cf5bb1ab98536ec55a7643e125af61f013feb0794b

Analysis

max time kernel
188s
max time network
246s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a-sunset-over-a-mountain-range-hd-wallpaper-4k-background-8hzzohha.jpg
Size

355KB
MD5

5dc4ba4683e6b6a74058af020825b108
SHA1

1739ff7e599a977d75c7d8fc5644e6aa72656e9f
SHA256

ad14e89636f8603ee56438cf5bb1ab98536ec55a7643e125af61f013feb0794b
SHA512

1a6a1a90f4c6e2c6179eca9314e62b1bdae4b0c8bc06599cc5b33cbd81b05914056619d5d8bee159447796a6c594e378dc3d82ed927242a9195b2cbe8e32adbf
SSDEEP

6144:BzKD51QWSA9dyIXIkzNCdYYG1O6mDPa8Urj+FkXKXsLbfCB6XPvuhBqzkmSlh0yF:EfSmhuYYt6mDPa8y7KXs3dPvEBqmX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\a-sunset-over-a-mountain-range-hd-wallpaper-4k-background-8hzzohha.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1080 --field-trial-handle=1200,i,14521020234331752088,2829615879480068674,131072 /prefetch:8
1⤵
PID:1380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1200,i,14521020234331752088,2829615879480068674,131072 /prefetch:8
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/2976-1-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download