05525b60c4f0cba32f409ef91fbd76c83e42831397f6dafd80574d63a823b56d

Analysis

max time kernel
23s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

images.jpg
Size

1KB
MD5

ec7439f3749e790d7a9d658358877e4b
SHA1

16cb5f5833a05a3e8fe81fb8d597f90aa6b01be9
SHA256

837f99fd6a6747cc238d16003677e7431cdd62d07ab9a99045084eb187f17cc1
SHA512

09ea5b884679613c00992824b4ea1133f88fff0542f890de730c2d27df0b4a26b0a621710f3cc01a3ee636bb549db147af70f1bbb6bf899a552d6c20d69975e2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\images.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2540-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download