b9382aef5853801313318dce135280bb8ead373f82867b3a638afd7426d5791c

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_0740.png
Size

62KB
MD5

13c4cbf5967ab4ea0e035ed9c2214bdd
SHA1

9d13d0628a5659589e762bc83494bf560c525006
SHA256

b9382aef5853801313318dce135280bb8ead373f82867b3a638afd7426d5791c
SHA512

3b91075ca464dc26fca188b06c2266406c7b33e46721616a24e6b3a9e38a70e1f54769eb6578cb941a9fc71d6cc9e4fd7d9e6d0b5ee453e0ce9259eaf9fb7135
SSDEEP

1536:OmL4T6eP4D0dsDOSWqwiu5Mri0dV+91WbdMsXUgsSFIggugigglziggrWggsggg+:1Lc4QdGWqwnari0dc90bdPUBpggugig/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\IMG_0740.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-0-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/2612-1-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download