8b78021948cf36290afe3da346858e780de6746377b2116414ec807f454dd981

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:28

Target

0a9e30ce0e92f1f994081bd5a4ab7817-fakepng.png
Size

38.1MB
MD5

c01f76b083336b8a5a14915cd81f5594
SHA1

6f1424ad648d87e35dbda6f6640c365e266c199d
SHA256

8b78021948cf36290afe3da346858e780de6746377b2116414ec807f454dd981
SHA512

db1bf198e0b81117096c4b5ba5783ab31f8c0b5f9d696ba6bece93ce4c8b2e66e2d5fae1f9c90f8e8feebe0c98180a9ccc0b23d6782ec4bb8d2741aa60659e59
SSDEEP

786432:WDETZDZyPZgdF3rm3gvfUf+AkUq2EVRuof3Z/A1wVVm2LZVBzXXy:8KF0ZkhrF4ZkLZKofpb46VBDy

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

620 rundll32.exe

pid	process
620	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\0a9e30ce0e92f1f994081bd5a4ab7817-fakepng.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:620

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/620-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/620-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download