ed3d83bc78bdaa2ddac14753ee8a6e3d50f6f9a000814d022253e7a7c617d00a

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240419-es
resource tags

arch:x64arch:x86image:win7-20240419-eslocale:es-esos:windows7-x64systemwindows
submitted
03/06/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image003.png
Size 16KB
Sample240603-e38qrscf76
SHA256 63189a3bddcc0fdfbb6f3497d42be664cedd80ce6aab77fb62860b226773ed7e
MD5 b69fd6291c9506835a19a14021f60960
SHA1 f0d4583551d55f6d93b94e2a01db5c7dd49cfc33
SHA512 8371d14da61f186584b205cf147363d7f0cee5ca55ee0ef21608ff3485d802e24e5292489c5748d527b4a7156ec0a3da7458369a1fc300bb3762e8ca6353402a
SSDEEP 384:dsZfZD6LVDperYc5OvpLpGeI3t7kb65Z0ycf/t2lwEb5V:yV6Lf7vFqPc3t8r
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image003.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-0-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/2560-1-0x0000000000210000-0x0000000000211000-memory.dmp