b92c73fd80d0356057d3b279d18e2ef7097eae67d0bf0ee03478f0bb19bef23c

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

selfbot/data/images/nighty.png
Size

107KB
MD5

a3f5e6169009151b1eefdda06e536110
SHA1

e0487b3cb4b75da8bd35991b9ac3823403799460
SHA256

a9ca8d6d08711c8b291c8e3ceeb598d8e15ecbf2f4368c117aff0bd0bd28f3b1
SHA512

248f4d892e6afbb869e1eff673470ac690bbe6253835fc158cfe782cad1ba54810260148a0e0ceed5f0d857ccd3a79db7ea8fcdc4279620eee4e79ca2ef603c8
SSDEEP

3072:+u1D3ya15HBe+3TRjznbrOYGi9SQ9E82poTkTmFB+:+uhVHBecR/vGgukkTWg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1312	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\selfbot\data\images\nighty.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-0-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1312-1-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download