b82c6ca7745508e59dabc0bd9f65083bec3ada10a1121cdaee82d4c4832f3e44

Analysis

max time kernel
1561s
max time network
1562s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

646347f880a208f3afa7b5f3_71-p-500.png
Size

47KB
MD5

db4674630ab4ac8097ef8f2e3a40890c
SHA1

7ce3ce366dcbcfa79d4284bc372574da3ee71d09
SHA256

b82c6ca7745508e59dabc0bd9f65083bec3ada10a1121cdaee82d4c4832f3e44
SHA512

7bed682783c4be4d6d09393a67333f4b91bf04d1fdc4c1adf4eebc6bdfde9504cf6d438e46b4a425dcbb1252268a8e147828ef951b31ba00086b0106fb2f99be
SSDEEP

768:F8kvK5C0S9jWeyrZj+/cxSyK3R99u2OXst59QHNsqta/rJdWSbTmX84ZQnImyTbU:F8ki5C0SB7yM0xj6v9u2O8VsNsqterFT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\646347f880a208f3afa7b5f3_71-p-500.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2064-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download