e0f42a0448846149d60407dbbd65714c7f76a79353a4830d208f127cbef84fba

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nova.ico
Size

4KB
MD5

a822520b46e3a5360f5d662e0c6a88cd
SHA1

b47bdebe13fc7b82cbbe13b9c519b4d0cfb76398
SHA256

e0f42a0448846149d60407dbbd65714c7f76a79353a4830d208f127cbef84fba
SHA512

3d5572fcea245019c3a216b6de4e92c08679d403242e0bf164a23c653620f48741a834803cda88375b9b057182e8981d3d131cfd17e2439bfc65d41a3d50edf6
SSDEEP

24:suAqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqQ:qdSHHTYL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Nova.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2644-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download