abdcafabf513c382ae53455f541f186afd6e75fca95696e863c7133f75ce5790

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Radu-Tool-main/data/images/2.jpg
Size

4KB
MD5

7ba01c5f564560e0a79c80076be86d50
SHA1

c4fac1d9fee3f18a7b0329b220b4f3968ac4eca8
SHA256

0ab9b6983a8c255c689fedd8d1330ce64c9d941e9d627f67a928495e304ba429
SHA512

c637863235af50a2c2e5cfb7fbdacfab1dc2f8eb7dcf1d52732dc0823c063f98629bef97dcc46588d670d9ef003fd437fb0173136357796da95882727f03b5f5
SSDEEP

96:3RAUFgkXb5Pv+SDhmuWcxq6C7fGwNxBsUQu3K7DnHXGVmeSg:3R5FHp+SZWcxZUBIu3K/nHXGoi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Radu-Tool-main\data\images\2.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2980-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download