4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-03-2024 08:27

Sharing

Report Analysis Logs

General

Target

btn_dark_1_pushed.png
Size

455B
MD5

e9d2c7a7ae25969a0e166d51c921660d
SHA1

4387b00f8c545a1b25156ddec6c98b3400e379dd
SHA256

835474b1387b98bd5837668661396fc7cfaa7c934d3422c923ebe9553e5d9552
SHA512

18da16fa24ce72f66331605e6f7938727373c06b8b97c1ef9789cdd5d4e3178623130a1fa01464211e9db33913c518a2aa1de0ee1eb8f09ab55f4e3082359efe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1692 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\btn_dark_1_pushed.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1692-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download