cda74129c2cc51a1f808695e163f05d4a9fc6ca2244e5d2c7f03d9f19d42d7da

Analysis

max time kernel
359s
max time network
360s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

glitchnation9.png
Size

950KB
MD5

f7679f38c3be7a9871f3b4da455d888c
SHA1

b0ef376ebe96e3a784fef2c2302bcae51cb4b923
SHA256

cda74129c2cc51a1f808695e163f05d4a9fc6ca2244e5d2c7f03d9f19d42d7da
SHA512

43e6f93f20ab2c7970deb2e31169e708ae7ec616c17e08fbdd7de82fb4bb89c512f51c09e3841109650f27d582f0ac678da47b88bd4a0a7408a6c580eba7eb66
SSDEEP

24576:J+H/c1UXLNk8YH2Mb/C17ZQW9m0fc8zsOS0AsxyQ49SV:ULNk8dSWI92cpYn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\glitchnation9.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download