4793acf4ba0aa6c6d9139caf8ffa2d7553d6870a8980d51df5bc11e3ff9c8531

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

apps/slippi-wiiconf/icon.png
Size

3KB
MD5

31d115d5f22cdc3236a62ac0b785a6df
SHA1

777d094be100e9357f2629b9180a24938756a9a4
SHA256

0e7c2dee6c7bec8e4a789550d923df7a7dd12d791bfafa747af64e9bfb57463e
SHA512

a1e1e5291c67f9f612d3b663cd30c3ca2b53af0a112b63f297930234790a252f8f83ddc5fa5c3b82ab37b95cb8fb5d75da6db608c62b8a9f70f0a828555d2e84

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\apps\slippi-wiiconf\icon.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/3064-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download