bd8c6adf7c223acdc31c1d45d178a10e6fada771f8d89adc33b4b08321af5706 | Triage

Analysis

max time kernel
1556s
max time network
1560s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 03:26

Sharing

Report Analysis Logs

General

Target

huh.jpg
Size

33KB
MD5

34ad6f121111013d7f91b7607866b8e4
SHA1

af32d617ccbfe230abaa98cc9c9dcc67921916c6
SHA256

bd8c6adf7c223acdc31c1d45d178a10e6fada771f8d89adc33b4b08321af5706
SHA512

fd7791ab40a5c09ff9bf07f3a6bfee63f8ad82a38f8da3616ff23ce82833d07f4705dced7a42196c4fca7de5b2de0d7ba6ceb5b30fccff78208d55472be2f499
SSDEEP

384:jPbSglvPzcUDCwI8e8EaVlmfyP5KR3QGcBemCi9nHqYatFXyMK/Lj/i5KGTfEB:3RxzcmCwI0lKRJIFHqYaPue/TU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1544 rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\huh.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1544-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download