31a51057a99052cd148fdd04a14156f0a7c2036e37fcda9fae3f1cc17f37f49a

Analysis

max time kernel
24s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bloons.TD.5.v4.0/Bloons.TD.5.v4.0/Assets/Textures/Ultra/welcome_sheet.png
Size

761KB
MD5

9dfdd5dadce9a797d8cf6dd30e38fc3d
SHA1

338a6e6ecd45df9f38e6b51a585f95cccccf75db
SHA256

2a3b155df2586ee1b0a4e66c04cdf33213d31c9efd46ae0cfb4d0dad2f01b51d
SHA512

586ea0b8886e0380a68a25b6a3823666e1f692502bef60e5495644fcc317372cb31787d8898ac6732da1616ce03be96c4f89396d49db7f64c03d3e44746f77ac
SSDEEP

12288:ZYW0FXt4aYld6Mb6VK04AO7G1zL27KhxS2z1F//3sVV5R6JgfPk20LKixl91JyGM:2FXtMb1oK04hC1zq+hhhxvcD/c2Zi79Q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Bloons.TD.5.v4.0\Bloons.TD.5.v4.0\Assets\Textures\Ultra\welcome_sheet.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2012-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download