Resubmissions

07-06-2024 14:32

240607-rwa75shf71 3

07-06-2024 14:31

240607-rvv6xshf7w 3

Analysis

  • max time kernel
    1562s
  • max time network
    1563s
  • platform
    windows7_x64
  • resource
    win7-20240221-es
  • resource tags

    arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    07-06-2024 14:31

General

  • Target

    13.png

  • Size

    99KB

  • MD5

    505a32576eabd41364f939506b068079

  • SHA1

    ee6320808b5080d2175d068fd8dd76273833393a

  • SHA256

    93671145902a7d91de40b62de1cad69016e65349d241aefdcdb22c957e3bede6

  • SHA512

    2f09091d3e465a8d77fb98f8b24b0bd36fa472bc6c0907b302df91d9080570d26c1a3949bfe77be351370da65e16c8cef1471a79818b6ac64c4a92685634be17

  • SSDEEP

    1536:MXycbhX2yImrkO6tiw2PXIT/LjgeNMiYwAIT83yweqBwmVCbZ+KZmfSIvtH3IsVg:aycbR5IrpR2PYMRwAV3yw2dbZVlyYUZW

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\13.png
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1348-0-0x0000000000420000-0x0000000000421000-memory.dmp

    Filesize

    4KB

  • memory/1348-1-0x0000000000420000-0x0000000000421000-memory.dmp

    Filesize

    4KB