249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 19:02

Target

$PLUGINSDIR/splash.bmp
Size

564KB
MD5

ab867e66abaad50036f8dca8bcf3b63b
SHA1

ca0bd657610ce7b5b86514adde57e2b0f18a83b8
SHA256

c14a86e456f5b9783ed3e2118c9e97de6306fbd2b40cf9cd0dfb821b945c3569
SHA512

24b122fd7f8a48e03b387308e91ec1ccc6025a44f3e65404a12679ed50ce7633ce9f6c5b86efbc175cbed716478bd015e42711bd0148742f1ddeca5e3dbb1863
SSDEEP

384:V6sr5D9wQM3Qxu6QejY8RGEHsDf8CdvCdXJWaTlnZIWYvylfQTexJ3:VHNaQM0uhSRGFD0CRe5Wa5OWwBMV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1692 rundll32.exe

pid	process
1692	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\splash.bmp
1⤵
- Suspicious use of FindShellTrayWindow
PID:1692

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1692-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1692-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download