ed1e10ee0cd794b7d253741f0893c094f11a0b03c15b62451ba17dcbb84a00a4

Resubmissions

12/10/2024, 12:46

241012-pzt4ba1dmf 3

12/10/2024, 12:45

12/10/2024, 12:44

12/10/2024, 12:42

05/08/2024, 23:13

08/07/2024, 16:42

07/07/2024, 23:47

Analysis

max time kernel
1562s
max time network
1563s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REGFuck-master/RegFuck/regfuck.ico
Size

4KB
MD5

a6063ec89716660f268529794522c77e
SHA1

660313cb597d0eaa780e7bbfacd5e61169096967
SHA256

c3de58be4e74c215973f43f0d3229b6f9806375dad23134eb39c66612a638198
SHA512

f46a3ee11dec4b9d09405d5f01604c32afa9bb8dc29c296d86206b34a44a6c4de1b2d2c3f175d2cd7d5042083db90e3ea56ae799e834c28961a4356cd0989195
SSDEEP

96:zuoKqDpskf6Cm5W4P7gtsW2S7rDs1QsKuk:J/GkfR47gb2SHDsBKuk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\REGFuck-master\RegFuck\regfuck.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download