7c3347c274a5f8c9fb8c076b3d745e509b400e21127067edfa77adf4ca40834e

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 03:08

Target

Inkscape/.background.tiff
Size

822KB
MD5

504125a85983b291dc8a46fb6d13bbf5
SHA1

ad58918e7b6b2db2a4a627607339c998becaefdf
SHA256

38897d951d211baeef6492ee243adf4f67d0748294c00f5656ca212a10ef2bf0
SHA512

43cdc3877b9bf1a7cc440c6cc90b67228b6c82e67a2590f1efc5f014c93b76639eb4b7096c420de2de4294d7efb952259f38d1fcc5a0917fa6eed803edc8bbdf
SSDEEP

12288:cpay9IENJJ9zzbVFZnbrTPvsD7or5l/Yfy+EJvEoZzSA87crBjHSWsRKIn2:Qzzb5vScrP/+yTFOD7SjHSWon2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4516	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Inkscape\.background.tiff
1⤵
- Suspicious use of FindShellTrayWindow
PID:4516

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact