f58a1afc1dc58f057f867bba61d28fb42496200665a0a60b9a0024a1834198a5

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_13_/Skins/Default/2x/bmp20256.png
Size

213B
MD5

43f61d85c67620d955caf8920622b518
SHA1

e386226f98bde20fa403a4a3cc412653db6b2154
SHA256

ec6e3d8f847d08525a8de23563071562a565e17730d085fb675ea3dd789372df
SHA512

beb95e4e75aea5b71847671beeda47c4a6fb0cf067c3f10cbf63e1c8cdf6b2c8bee3f8fc5469b398ffcb4af22ec5a5710f8ca13d822a321ce4e577679137b62d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\$_13_\Skins\Default\2x\bmp20256.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download