55aa5ea3f3aea2186f963209015fe71f37244df3149661746f1aaf7545fe95fd

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 13:47

Target

geode/resources/geode.loader/mdFontMono.png
Size

12KB
MD5

bb67c024661bf9ee68b715d2329b3103
SHA1

e88ef9bf09fd1fef95914356e26399694e72b3a8
SHA256

3473a0d1c7e2acd3aa367d9eeaf1963e6db0a0c563b24ceccd7726aef58449ab
SHA512

7d50582bdd7be1de2f16c743b7c4f19c33ca03abd27bac2410f37a5eab99797f0bfb1331557cc96ab1ce71907af7250946d788d2ff64819420f1424803658f76
SSDEEP

192:USw4CMUOZcBpP57wPnoNiSQDNNT7tcHFP/vb10s1ntWues7xdGFu6F60lXf50V1z:USSQcPB7sSQRNTZcHFD1/IL8CuCf50Vh

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2584 rundll32.exe

pid	process
2584	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\geode\resources\geode.loader\mdFontMono.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2584

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2584-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2584-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download