772f18c2bd5370c076786a235f16ea34decfd6bb6352b96df0a6f0ed6ca2a9ca

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dolphSol-Macro-Amraki-Patch/images/glitchTest.png
Size

9KB
MD5

2cae2cdb45d7fafb6342b3a6581a38c3
SHA1

b64b95bea6863da476ce82ba1ae26675aa93bfa1
SHA256

5e6b75ca1a6bb5a13d37a900f3eb0baa0193d538c0e88a68b7a7343c74ea0f1d
SHA512

d4eb9118a67ff52784b577725fb0c8091c01eb03f741e9b9dfab05a0c40f1f14a2e1c2e340d05b69eab7fd0bad880163bb1d2ab97f347e56aa5b37e14bd454a8
SSDEEP

192:OExbTCSrWAeLOmohUKUcxqzVjVoCNY4/qZ5XQ00OSvXkugpLW4:OsbT/rveLObhUKU+qwCNbC3A/OSvUB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\dolphSol-Macro-Amraki-Patch\images\glitchTest.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2552-1-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download