ed3d83bc78bdaa2ddac14753ee8a6e3d50f6f9a000814d022253e7a7c617d00a

Analysis

max time kernel
46s
max time network
18s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
03/06/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image005.png
Size 393B
Sample240603-e38qrscf76
SHA256 0f59402ed356a4fafb032975bf6f3d9503aeefcd52709e090e31e650db810bde
MD5 d9a21ca574ec928762b8e9d9aa3bee49
SHA1 8964d03a60f3d2d34e53b4ca2c8b31c98451b8e5
SHA512 95edd71163a1f5711dc943c686cf432e29e6ce739d661b2a24cecd8341d88aadf0129a48e09aac8df2b1e080b2079a8264a49e633e08fbe45d2666d4d05cd573
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image005.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-0-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1476-1-0x00000000020B0000-0x00000000020B1000-memory.dmp