78f8b9386a63c3af11a99b5263851996f722db160edda13b59a8855a4bc0eb72

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

selectrss/pix/donate.png
Size

10KB
MD5

e848a4c2cc32a40b5f290a18f256afff
SHA1

bfd0832aba5a204330ccdfe452b8167d6fd26750
SHA256

8868ef2a58ae641bf929c0601951951d509b3be87021e8ca9988e9f264944fdb
SHA512

cc29f568a07c0ec79bc2c3d514c39b49bedda0e96e995997ffe6799a1ab2d35bb3c88f2dea8408dad45a9189fe7493dfbebcdd2bf2a1e29ed25a3c4579673f52
SSDEEP

192:bVNDR5i+8AIzCZJ/R85odc0v1gpVqJLX8uL2H6XWxo2RaZ2fq/e:bVpiDAI8/Rc0AVqJj3H2Rnv

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\selectrss\pix\donate.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2748-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download