f19a78af49f7491a569092e907e3df8175429641cb6f0031cd6703cde239ef96

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

geode/resources/geode.loader/BlankSheet.png
Size

320KB
MD5

99f12f413136e5a0f929a12885e411fb
SHA1

35d933408ed391dd3d3334b90d5d814f7f1fc243
SHA256

8069d127726b63a39a39ba7ccad9813f0387979a8fdf50fa8cc1eac9afecea51
SHA512

f3fdd466c7bd5a2eafe6c9d6faee82ed8a6ba6cd3ad88fb333f33f529aa0c393246de3e7fcf285d9099669d5f4c9f8d63249dfd1104fb2f0fe20ffd481814a60
SSDEEP

6144:aDDN07YMUduJ5zmHhMoNZiBEe5RmSGAji/3N35DRbMOQzwsaFzcKhAGy:yhwYMUduJ5zmHOu7AmSGdvDDLBsaFzcP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\geode\resources\geode.loader\BlankSheet.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download