1792f9c3261f92a104c753dce80cd2be814af321b1836314a602c8cc4385afc1

Analysis

max time kernel
26s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

logo-national-institute-of-standard-and-technology.png
Size

20KB
MD5

5cb2912eb0f9a0e8a989ca49678df23a
SHA1

51ef28ab11fe4c03e2cb5a5e7aa5c232d94c4196
SHA256

1792f9c3261f92a104c753dce80cd2be814af321b1836314a602c8cc4385afc1
SHA512

657ffdfa768daae983ae77024f3145c60f099432e3a3160791b156fa6af553bc427af590a72b65458d30271e77b483a0bb6445dacc0b6f03b304ad90596045e6
SSDEEP

384:1aeWIItS2ok+ACTiCTH0u+tE5e7XdowO23cV0WjErklLswX0nxz80IE69:17WxtS2o90JD7Xg9uWEIlJkVK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
828	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\logo-national-institute-of-standard-and-technology.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-0-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/828-1-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download