7e3a6b914dc1f307b4183e9ea01d97deac47507db7880162d321ad6dcde040dc

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

browse_pressed.png
Size

162B
MD5

7b1ee5a3b5565a1b22bac0ccab3c1d33
SHA1

5bfa966646a0b77b7bbcef38a0330aea8b116d49
SHA256

b3f1ef8566639dcc829dd68b4153beb16775be845f90f5c0a854f3402e722cd8
SHA512

0c2832a0452115086b0f8d12fa47a22fccae566ec4ef4d0c80ebaa1517f1a316cfcbc010e42fc0b6b99fbf2678430e28e449f4e8351128eccf03b6aa994ced88

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
292	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\browse_pressed.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/292-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download