cc0d28b4e4873998ce60be373f4b1ad04df51d68a251ab80c7a583560320e3cc

Resubmissions

05/04/2024, 20:15

240405-y1l9jada97 5

05/04/2024, 20:11

240405-yybp1sce9v 5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Outlook-signature_.png
Size

236B
MD5

c9d96e84e863efdec8851a6ceb701554
SHA1

79d53371fe275505852c3ca76aa29bb6a598bb9f
SHA256

ca04f9d74bcdbefeb96a6eca4a3cedfd0f67794d9f3e384c3b0b8dfc6c302a81
SHA512

79f29eb27e1b2fe94ddb8d921e65dedbb9d226581ad3200d389c58814ec13dfb19c7d23f9368303496e0c75eb2b6f5be021b876cd05419bf68c03597a044a969

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Outlook-signature_.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download