2468a1afd4808daae3e762ceafa3559b7633a836384358bb652bfae77791ed6f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

textures/blocks/deepslate/deepslate_copper_ore.png
Size

675B
MD5

e04b46ab9197e586935576f0172a3ece
SHA1

c0b1f36416618701e2c1cfb752af7d2a74af70e9
SHA256

9a341d9cf680a3f2809293a11354d9be9687dca748763c1fabbf591a174d636f
SHA512

f8ded8dee3609c2055ca19872cefcd606f13b66c701aa845a63cf06f84eac5bb7b7741fc452791c8239f004c9c6dffcbaa59a778bc3282a454c3ffb091c8c118

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\textures\blocks\deepslate\deepslate_copper_ore.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2356-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download