ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

Analysis

max time kernel
24s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 23:31

Target

$PLUGINSDIR/modern-install.ico
Size

210KB
MD5

9f49cd02b213aec852ace2f045cfab18
SHA1

2624aaa927e45440656d9744f0c13ae53a94becb
SHA256

ced6bd38e3b6731ddf63ed4e5e41d11d9935e220addd0a2d798ce2b7ada8d394
SHA512

185b0066a3de7fc1b2b42670c2d42df3449cf16326629b9925f88181d7c590d73fb5bd94eeeaf8962a3406a65059de8c4edab01503d373986b719bed4f371476
SSDEEP

3072:wD2vb3PtA9/hdTqQfn+oyCRpT6iaA7MZL4JWzFsU5UXV+b5hIS4S9EHf:UM7FO/Tl+oyCRdrbMpaWzF5UXV+bluHf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

1052 rundll32.exe

pid	process
1052	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-install.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:1052

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/1052-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1052-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download