62c476dd3709ae1f276a04cd66fb88a33d0628417a45adb8df2a7e466cc71d43

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_0136.jpg
Size

47KB
MD5

084c659cb3ee22e4f1e585d65fd136a3
SHA1

f98f81f7c14f1ad0b2759ccc4fa5333da860ed71
SHA256

62c476dd3709ae1f276a04cd66fb88a33d0628417a45adb8df2a7e466cc71d43
SHA512

5c39e33f79a1274d3f108202a3e51caa737d0140c30e9b7ae7eb4df50288af0db3e5c261eaff133490ddaf830a3763925a3350172a3ec7c19708e66d99adc210
SSDEEP

768:xtPKephYk8/t2+RBdiboPGAf30+SSSSSSSSSSSSSSSSSSSSz/6rAA:xdKephp8YUPGAfk+SSSSSSSSSSSSSSSb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\IMG_0136.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2884-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download