c911fc796b9bf671e9d239a637e14f44f55cf8617e7a76bbbfdde77d89152faa

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot.png
Size 311KB
Sample240609-sej96ace26
SHA256 8cf395007667bddb126fdb2857777fe28e4285a2b67c0405d357717833c21fff
MD5 20c25403925b1f167de13e5e2652d09c
SHA1 800f5d5cb3467aeea6a0096df7c6f99ed3a289d7
SHA512 117aaf8c6925e8f262456ca6cacd901e290707ee34d9fd67c378dd649df2af7d108b1f853f011176000d0a1474594c968df056039b5927b35284631d829dc292
SSDEEP 6144:nJbhBxnQcvURcbQm50z0HfZIIblrEpymUKJz54apMzyEBnskzlXFzPCliE+K5Vz7:phBxZZ5S0P90zGapM+EBnskzlXFz8iqf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Screenshot.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Download

memory/2440-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp