0dcfcccd6ae895d9e5dbf703cdfc8becb6aa20d56e756bba84c84837cf5c55f1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ir41_qc/cephalosporin.png
Size

395KB
MD5

020309e5adfd756102ebcd09bdaac478
SHA1

31bda79d7e1dee1936d41181544ac69521760039
SHA256

4eba6d3c38122a623e5adf8c07fa395be652b93fbbb0be29b74ad29f4ca4f018
SHA512

757e95ddd748b31ba24c0383ffe75c1c97807a0e62a7a28a018dad796213ca3255fade0a794d62b274595ec29bbfab92f1290e46e4f9496dc93850bb8572e1ce
SSDEEP

6144:or4jfA/GhI3pbktDc9eoj4cLs57fiQnJdGUIC1PkMt7zbKUoEleuZ3y1r/Vz37LB:gsSWcsOY57qQJg5ePznLXZ3y1pFb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1968	rundll32.exe
1968	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\ir41_qc\cephalosporin.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download