a3a09f65f7f1065108c49903f9bb61596d15f8c8807da1d79a06fedaef6affed

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
关于住房补贴申领的细则.png
Size 90KB
Sample240409-bnvc2sdc61
SHA256 a3a09f65f7f1065108c49903f9bb61596d15f8c8807da1d79a06fedaef6affed
MD5 fb623ffdf69d2cf3020e501638d0676f
SHA1 a75a1b4b371a073ee576e57f92da39e5d39f71b2
SHA512 21b1addeea3b5f15c784cdc9b0d9c139f26012aaf0b4a7160bacf27eac669fb096f19983906d62a94ee6b2904ab0deab866dfc626a1f816e04beda4d1594adda
SSDEEP 1536:8oipwDOey8uWpPs1xUZswYM0lTd1gEu1FEjF49mViGU9ZpUOp9xu:Ji49d1sjtwasT39mVRUb9w
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\关于住房补贴申领的细则.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Download

memory/2212-1-0x0000000001CB0000-0x0000000001CB1000-memory.dmp