51243079995f79a55cb37c432a3ba9e38689e78a215f109b409bc19b4bb7be8f

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 07:49

Target

Payload/Apollo.app/[email protected]
Size

9KB
MD5

d2cf69103466f8158f25c53649f327c5
SHA1

fa54bbc3007f961c576f6916f651467b8cc84a6f
SHA256

04ce948b3c0d425c42ae4eb322bafc2406fd63552d840bca24e5a2be79c16a54
SHA512

5757ea128b0a3bf2fe20bbfa35b0f1cf96568a5e8801f06d6b0fdeb7f5eb1b95a4c2d12f42e65785ebf6b8ae274e9c65b13c83887a9f770485578dd856eb0295
SSDEEP

192:SIQho/vDQ3MYTi+X6J2T94BJtJD8JlENBfsObOtl7lpnMgLCvGy2E:Lwo/v035hqJq9AtJQJl6lbOndCvGy2E

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Payload\Apollo.app\[email protected]
1⤵
- Suspicious use of FindShellTrayWindow
PID:2408

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2408-0-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download