aa7857764158b035eded7a0aab4026005f933e14679dd502b5fc6459fc6d53db

Analysis

max time kernel
23s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

IMG_0663.jpg
Size

387KB
MD5

b5379dbd8ebed0997a18940b24e8291a
SHA1

ad385fe19bc7875ee9a580bfae95f1d104d81ea3
SHA256

aa7857764158b035eded7a0aab4026005f933e14679dd502b5fc6459fc6d53db
SHA512

0f4385d8a2ff54a88125fe20494ebe66d5e9c9de58ea647455ef146f0952eefda83bb86ab8161f5d35523591614e0d9346106c1c75963fadf0130b4d3a117d84
SSDEEP

6144:Kijsc0OBn4AkeH0bmeJ6IpgpCnEaH3qTEcjxzKgBM+6cULyYfhZ52zH:d8SlzePpiwENRKGM+nJUXQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
848	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
848	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\IMG_0663.jpg
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/848-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download