9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d

Analysis

max time kernel
18s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app/src/assets/icon.ico
Size

11KB
MD5

372b8e595552272d8980d7ce68a22a45
SHA1

3458abecc3172f86c0a42f889402a700964a7bdc
SHA256

9a6b51f26c9efb993a02f67582477d9b524b029af5d6b1bea046840012dc110e
SHA512

bb712405ea0c0ec66add82abd04ca8f32e07bea7e4bbdcb2bce53a16caf8d9bf2a514ec8e647739e739f995931fc6d04d155e8b2f381fb93765024a4aebc1fa4
SSDEEP

192:5oE/UpLYcasZP5WUZ0iClTa8VhjO/wulukJ4M8JQTtDdtEDQ76nE/Vcb8VM8eQvP:j40cNZP5rqiClfhQwuUek6tDEsiockfP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1828	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\resources\app\src\assets\icon.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-0-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1828-1-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download