d3abf13396b4cd2aef0efc124747f4c186235b008cb9dcc060a8af4b0280e434

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DSCF0197.png
Size

4.7MB
MD5

aa88039fdb5f5dd60a894e1d3510386d
SHA1

5427a81d0b5b90dcdf5c61aabb8fc9f3a6ec48c0
SHA256

d3abf13396b4cd2aef0efc124747f4c186235b008cb9dcc060a8af4b0280e434
SHA512

8334dc38b03f6c4e52be636a4d3345dd55457de4b6ec2e8c7991d2a942ebfb01f7a740d8b6205b49dafb721a820aa6c1f117496f35055b8fd3e31f9c17752b10
SSDEEP

98304:Vgs8UF2ZuYpG6ugZP4nNRxqBZ1h3Z/rmDULOq3Zv+/L7F1kGgPXbBWHhy82Vy9:VD3p6ugSn433prmDULjZv+/L7FfgPxx4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\DSCF0197.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2212-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download