abdcafabf513c382ae53455f541f186afd6e75fca95696e863c7133f75ce5790

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Radu-Tool-main/data/images/1012755631687602276.png
Size

28KB
MD5

6c0223575c1c0a50e25aa8869bedd688
SHA1

dfedb471d0b561ece2e17e9ca6426ef9cb26a363
SHA256

65a323a9fefe749a5e79e10d5e95bc98f446587979dc074e8f04261bef96cbea
SHA512

5a6ddfbe76f4a08ca6b9ffc20c09c3e8346783b0ca9784442a42698204a97b87da9a091119217bf0beb54672333f3d1f648043047830cefc976903fae32b3cfb
SSDEEP

768:CgLqnvhy+8+otTtzjVL6igOcjvp2O0OKq8aY:CgLYktzjVLaOcjsNaY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
612	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Radu-Tool-main\data\images\1012755631687602276.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/612-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download