957c4185da5894c6746b3225a5137e42a1130f4c20ba58148c0f0ee258875019

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image001.png
Size

15KB
MD5

095eb30cdca4767a06da9de170ce8ddd
SHA1

b0a39279a248c983fb39a4a7dcce7450c2b7d2ef
SHA256

505717214fc77a0d219988db6064b08c9f88bf16530f26f52917401b15c75581
SHA512

aabb583a53232e2279b711fd99a4f09b9665d16dc4c9b8416b426a7e3803c05ee45351f818e2a421ea96f31eb59ab839e4c0938c3fda53721de10eff0b7ca0b0
SSDEEP

384:327ul1bmFxjNONGhKkoVvGSlAEHli3cz6oXM008u:3F1bmHhONwohFHOczq58u

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image001.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-0-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download