192fc1ee17532a8b774faee41e4a984563800bbfcb9300ff4c6ca1bab53ce992

Resubmissions

11-08-2024 12:46

240811-pzmdgathqa 7

11-08-2024 12:21

240811-pjrcgsygrj 7

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChessAssist-v28.3/assets/16.png
Size

103B
MD5

2d0beffa548499dd1f09d1b1ded4f561
SHA1

339968bc9df174481c8f2393e643d0e371414e7c
SHA256

9c3f7bc05ec9eb38a85a613f12792b349d81b075d8121805bf17ece25f39f251
SHA512

4febb22f71909bee2a40d83257f650894107dc14d2408edec34523eab62a87843642e8311cd32f90d9b9b203ef9ef1b9b6a59ec40f2e2bbcacb6c594423776c2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\ChessAssist-v28.3\assets\16.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download