ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 23:31

Target

$PLUGINSDIR/Help.ico
Size

187KB
MD5

9ca6d8dcdc3a93521270fcb52c33e491
SHA1

42da181d0f73676197f50f3a2203708dd2543c0c
SHA256

7056eda1128f8a3a0c7217885972359cee99b6a62a62d4bd7bad79b04d7db227
SHA512

d28bce4de41036f25493ea28c64e840f8b62325eee6dbad03a4bb32439396aef16cf73eaaa95e975b82786c2aeac4eba86c13a6d703e616ef3ec82f41e463e28
SSDEEP

3072:tqh+r3XuywOLAr/wC1K07seG4ohh3eZryX20A90dc66ElkOwkC0yW0sS20XW607p:TLuywOuwz07seG1hdwryX20O0dc66Eln

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2708 rundll32.exe

pid	process
2708	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Help.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:2708

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2708-0-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2708-1-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download