39ba31aac730686e81b867c0dca91854fb378b9f413d6d3429e6ba280eed4230

Resubmissions

16/06/2024, 14:26

240616-rrwy2s1aqp1

16/06/2024, 14:22

16/06/2024, 14:21

16/06/2024, 14:18

16/06/2024, 14:09

16/06/2024, 14:04

Analysis

max time kernel
48s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot_2024-06-09-16-49-30-136.jpg
Size 66KB
Sample240616-rdms8azelm
SHA256 39ba31aac730686e81b867c0dca91854fb378b9f413d6d3429e6ba280eed4230
MD5 5898d08fd37df603e0bd2c2814a4d95a
SHA1 1fc26206ba2ba82dec4c68a47ff0109a420772cf
SHA512 0102560054efbf259568c56d3b8de2eac1ab4d6c07cae7820f4860fd1dfa290afe2fde176e88a3bd04816833d6bc86adc0e5d9cf12a1015eadb41d8c30574a02
SSDEEP 1536:8AeROE48psEVm3WuR3zt2G2GO0I5OxNh8w0AGePfm3:b844XmWa3h0GODoNh+AGAS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Screenshot_2024-06-09-16-49-30-136.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Download

memory/1032-1-0x0000000001D70000-0x0000000001D71000-memory.dmp