b2619f4d0d1b9f22f403f7637e65696372bd3bd72d8157acf95bc7b4036e62a9

Analysis

max time kernel
1561s
max time network
1564s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload/Roblox.app/AppIcon29x29~ipad.png
Size

6KB
MD5

f9bb4ea5070c6f7b5da1848441111b83
SHA1

41242279b2bccba87b89b9bf1ae08efe1652ab5e
SHA256

29b88926a821799960f56fd99794499c6a92d59cff024d14e62ac0a267886fdd
SHA512

efb34dc2c71c3ef9ff6c971f31808f68b9d7e1d50e13de2277470a269e8c18085967b21c66bcfbb9c212bcc0e1ae4ef59b2352e68c76e71dcb1917169912caab
SSDEEP

96:TknmWq2O7UPtDNfb/tFmS5qBOoNQtLPWyqWGiw+YyqmDXX7xZXLxZSqaOJhGiGSP:TknJuxEvjpVDQang47wUWFLJ2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Payload\Roblox.app\AppIcon29x29~ipad.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2328-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download