e46a0a9810193509839f7c21e2358e16195ce5a95d9609064da9fdec8a1282db

Resubmissions

08/06/2024, 18:36

240608-w85dzaee2x7

08/06/2024, 18:34

240608-w73hzsfc667

08/06/2024, 18:28

240608-w4d18aed517

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dreamless/assets/images/icon.ico
Size 66KB
Sample240608-w4d18aed51
SHA256 a02720e82091db671fdd5de080fa7a01330349788522e200232d8db5f99c6c90
MD5 6a7d9b5247b2a4b4a5fbf117d73556ac
SHA1 3040aec4cd4bdaf76e1916e9b3f7d95f2320644d
SHA512 c4b5a76f4c02fcf7962c305079b25ccc48607e9cd677caeb92751305d364879595866182566dc4b7c5a988757b2e29435a8493b37ae7e20a2f2c7fb5e0e7365d
SSDEEP 1536:4AUaPQ4EXJ6EipXy9FMXsGjB+V7DQ4X63AsqiGwHak9ireYbLS:8rXni52F47927ogw5aO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1192	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Dreamless\assets\images\icon.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-0-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/1192-1-0x0000000000210000-0x0000000000211000-memory.dmp