c63799634e85f95f9b6160f64557ae171f79f67305cbfbaf8b6f4218cf1201ec

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vitaly.png
Size

1.4MB
MD5

8beb4b0676d3c064750be6edad0764ba
SHA1

020d2082f15556b277d2df90098f619570e5e053
SHA256

c63799634e85f95f9b6160f64557ae171f79f67305cbfbaf8b6f4218cf1201ec
SHA512

dc28c8f1ae8c9a4fc2fa9e61e533a7367d0e4485ed1c0bbe9c9d64b7a14502f3d2e727906d2efd6f30c067f273217c45c63256ded91be9a56180dc3bc874733f
SSDEEP

12288:7iHPj/jx/b1Zgj9yLJ4/eFhmU45tcm5Ftj:Ipb1Zfd4gk5tr5Fh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Vitaly.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download