ab66c8916f3c33e070d317f9df3297682cb5cc65d1b3e348c12a0f81bbf5028c

Resubmissions

09/05/2024, 17:28

240509-v2bbwagh343

09/05/2024, 17:28

240509-v2aqcadf9s

09/05/2024, 16:07

240509-tkzsgaae3x3

Analysis

max time kernel
1559s
max time network
1560s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sung-jin-woo-and-the-mighty-dragon-1wpi9nrfqd8uxujk.jpg
Size 151KB
Sample240509-v2bbwagh34
SHA256 ab66c8916f3c33e070d317f9df3297682cb5cc65d1b3e348c12a0f81bbf5028c
MD5 4ebab1a755d68d51f117b63bc1c38062
SHA1 716e8180f7b80b51bccbf3c371a138084187da5b
SHA512 c602633e16b1af85bc3487c4d5cfae4829b3fd204f900f4241e9607c9eefeb901fc0b56b735cd728012e253dc0be048ed23a3ebac25da01f3e8247211ed8dbb6
SSDEEP 3072:egcm6eJm2rTAY3a3bU+Zzz1LBCbZpOBLrqIb/Y4N4fwZ8dL:eBmP/fraLU+Zz/qZpOBL9bSfwGR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\sung-jin-woo-and-the-mighty-dragon-1wpi9nrfqd8uxujk.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Download

memory/2968-1-0x0000000001D70000-0x0000000001D71000-memory.dmp