c29d61f41053ee8e574edc5a3059c99a71b57bcc189dabf6d13e93922835fe37

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/minecraft/textures/item/diamond_shovel.png
Size 223B
Sample240724-cs4b7asglm
SHA256 378e7e03d1d61a0502fea7e29768b6362c1785a22d3ac6e7127cecda28f48a06
MD5 f61f2373db3537be799deaaebf65d2e8
SHA1 cce6fcdfffb63e4ec1559bea70e088fcff73dac4
SHA512 5c59b7afe25cf4c6c57eb00e2da242e2dc2306888129720d36f757a0f9a8ef21111b16128e13259fa5103df04ba51cb603cc7c699be9b26f77f2f46a5f69a1b0
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2624	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\assets\minecraft\textures\item\diamond_shovel.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2624-0-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/2624-1-0x0000000000410000-0x0000000000411000-memory.dmp