59e0d15fcdf92551a204c7e71776a88f54ea9df74e2ba2cfb04e7582c04dec81

Resubmissions

31-07-2024 04:57

240731-flg26axflr 3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
31-07-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hoic/buttons2/buttons/add3.png
Size

3KB
MD5

ae39f32971ba9b649e1e817c2cf61e8e
SHA1

a860f46276b61a7ab2a045c80ffea5794aac2eba
SHA256

a92e7c8347ee769a0a3d69866a7925c79e2ac885d14116dd882223b6d752572a
SHA512

08975a8a9a407dcd4c8dd2324bd9f562ee8e73cdcfc8cd8217a661e81eb57b1a7d7e8b9b66227670f1c5d4957f1151c56438aefe46c6b602c4c80f047eb8ae06

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Hoic\buttons2\buttons\add3.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2776-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download