f19a78af49f7491a569092e907e3df8175429641cb6f0031cd6703cde239ef96

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

geode/resources/geode.loader/APISheet-uhd.png
Size

336KB
MD5

4f9684eeb8799d7b512a9052676114e5
SHA1

8a927a70a72c76a651c25d4314abe0f00457fafa
SHA256

8a669d0c93b18e787df32aa17091a5db7fef992a3cebdf4e5a863a264b1d7699
SHA512

7a99cd629f7d24df9fb6e240dd603a42ca63c7247a7bc264d76160f286658646e41324a5e613723f40adb2f0ac9096e25ed6c643d079f565f3c470b584b7de78
SSDEEP

6144:FyJjQQ250wXa0+hCrCmacxAn4yf2PvRN5P6UUxv:kgSwfswTbAn4L305J

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\geode\resources\geode.loader\APISheet-uhd.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2460-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download