d88271eb4440a41f65cad7e1d6c8b6b5f5d627d2bba8783b7ca76890467e9947

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SmokeySpoofer-main/SmokeySpoofer/Logo.ico
Size

4KB
MD5

7f51eb2ad9c4220b58e28d1bd70b7429
SHA1

09ffe26b93ad8f1a95da0d78684f5fe8cd48de62
SHA256

eb431c0bde63d5e87532393c6606b17136fb22406a00a5737539ecc72ff7e2e8
SHA512

44c8b4a657aa0aecbacca312eac6338daeadef3e72a122622c8a3ec1477bde7d3d2d9a928cadbacadea9c751652328778f2a061ac4a4f04531cdfd0698aa385f
SSDEEP

48:tfTWDpv2emihLnysI+sz2vlrqY5bRGH7i:tfTWNv2emQLd5lfvGHO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\SmokeySpoofer-main\SmokeySpoofer\Logo.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download