f193d7b8e8340fa25a87600597a2a1314715996265838838c71f68b6bc2eea97

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Screenshot_2024-02-17-21-23-44-898.jpg
Size

906KB
MD5

e140f754232a175356fbe8564d30d48b
SHA1

a31411980d855a737ea8fa33e6986e1952a289fd
SHA256

f193d7b8e8340fa25a87600597a2a1314715996265838838c71f68b6bc2eea97
SHA512

653d1b367779f5f6c07ff6eddea84ee7d24c5e1d2b8aac790883182099d3fb097c177cd36f522523ba4754c35e8d449dafed1af571389cc5f943db40f08a3967
SSDEEP

24576:cjW4NyGC3MoF0eLi8ssZPUWwxlcfgsra8sf8uHEF6bD:cq4N5j8ssZcWHfgslM8ugo

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2952	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Screenshot_2024-02-17-21-23-44-898.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2952-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download