de198448159376ac6ecf71d527aba4e364ca542e1b552cf3492c7a5d7f5442b0

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

293B
MD5

4f1db286206f2aa4d9ea0d73d4bbeae2
SHA1

d972ddc28dd70410f96be2409dea29dd8b25bf3d
SHA256

c62bccef49832be697e41dd409f21f2bbf02fd2678276b10c5355234f925a6e0
SHA512

d96ed972d39b7b0e4a83dfee48c7a90bab74dfb694e9142ec3e3b991eef3e6df7acf602fc0fe8b0b62ab7753cdeb766c8c1cbeaf65b03a8f956fceb385b2e755

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\[email protected]
1⤵
- Suspicious use of FindShellTrayWindow
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1548-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download