772f18c2bd5370c076786a235f16ea34decfd6bb6352b96df0a6f0ed6ca2a9ca

Analysis

max time kernel
23s
max time network
20s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dolphSol-Macro-Amraki-Patch/images/UIInformation.png
Size

28KB
MD5

eed57f3ea09f33eb71e991c60632fb70
SHA1

713458b1823df9c0aac71f45e392aad09a7a3dac
SHA256

e9a488d612621122d35beae53da5fae652c32a96371428c124e5013d1e804a38
SHA512

32c09fd7d050ed51c428440d137c5d801dc55030f7dac225db430be7fdcdf87028798518284b273ea516b2d9c50ec39d46cbc3546240916ae004759b6d629547
SSDEEP

768:GSA9vuOivptHAow/lj8wOrljxFfaMi9K/uhRhttT:GSsuOySow/l1MFfaMi9Koh/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-Amraki-Patch\images\UIInformation.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download