2468a1afd4808daae3e762ceafa3559b7633a836384358bb652bfae77791ed6f

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pack_icon.png
Size

12KB
MD5

deeb1fe562a4c6ca659ef02c8088f9e6
SHA1

0e37fa13f7a931fdd48ffe5269935b2fb8becb91
SHA256

c1019c35f6788390e07b451babd0ce2bc009a90ad2be9496041db3308b5df1f3
SHA512

2c4247ec9fbd414ac279886603c9f6f90df303f3c1e89034c92dc3f0cb00aa05d2ad1b52044d117fd90aad8a06f059d7810049deb75977af91fcdf4e7f5e8025
SSDEEP

384:kWAdxgbi0YPFtjJTtdL8uu/NNiFMrMtgpPTmfdr:o6iJ/JjK3ItWsr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1456	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\pack_icon.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-0-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/1456-1-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download