e46a0a9810193509839f7c21e2358e16195ce5a95d9609064da9fdec8a1282db

Resubmissions

08/06/2024, 18:36

240608-w85dzaee2x7

08/06/2024, 18:34

240608-w73hzsfc667

08/06/2024, 18:28

240608-w4d18aed517

Analysis

max time kernel
1559s
max time network
1560s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dreamless/assets/images/image_1.png
Size 263KB
Sample240608-w85dzaee2x
SHA256 1f5c008c83fbafa8915502c534f1a604e4f463678a21e9b0ff566f9665072569
MD5 35ec183a0505ddd4a711f3872d1c85b8
SHA1 9b7c9d1f1d02b2cce9004e0df984292bbbf7d160
SHA512 660734fd0f3826ddf13aa7aa060a844f99053b23e156c2b4349fd82e5fca5e51ac6b6c504ae810a4747d4746f1ef5ae637cc110fc6f26c5bb96b8fb46bd8a827
SSDEEP 6144:ENgWgi3ovj8kl91QCldVWyNZn1QVW5ssYuZ3qod:l5i3ovImdVjuVC3Pd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Dreamless\assets\images\image_1.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-0-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/1660-1-0x0000000000410000-0x0000000000411000-memory.dmp