62c8eee8c6e82b7c9a4b903dde84087c8e433188d7e725f8ea6f8ebde9f977a2

Analysis

max time kernel
23s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image003.png
Size

605B
MD5

69b5cc85e1cfb356c67715d093da86cd
SHA1

a27b3adc12a49cf8e13121a0ea1f86392f256f15
SHA256

4807fc058fe2ee02c452121ce402daddceef6800b48e0cc520fe92c60015f8a4
SHA512

565083049a54f26363a48040a3bcf00b34267e9f77791f657e1d0f2151f578e3f21f577e4927936ea6b7d7b0382687757ea36dac389421b2a1b451e8a451f709

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1020	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image003.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/1020-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download