2468a1afd4808daae3e762ceafa3559b7633a836384358bb652bfae77791ed6f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

textures/blocks/deepslate/deepslate_diamond_ore.png
Size

697B
MD5

d30e0b5854ecc438a1645a50da3aad9a
SHA1

d6d315c0c98536c4e38d542a99c5e2593b44ffd6
SHA256

96af1a9a3bd31afe10919e176189bd65aad63d42e96fa26bc0cf5c908cf0fd0c
SHA512

98c7e2febe4e3768a359aa1882fe29e1a78b03196c12a8fdc43e3bcb2293330ff8b993469b5d10cfbcfc859d18b582dc5f51b3ae098de9ebc9ddcc8b507e0d85

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1624	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\textures\blocks\deepslate\deepslate_diamond_ore.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1624-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download