fbd2fc91df25ccd0bb980ee37e092fafa2a2c63d659a98565684006a9e8f72ac

Resubmissions

28-08-2024 08:25

240828-kbjkfs1eqb 3

28-08-2024 06:36

240828-hc6p9szepj 10

Analysis

max time kernel
16s
max time network
0s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

purim-0-311-0-409.jpg
Size

41KB
MD5

b7bd9c98d26f6d64bc007f8f10519cd8
SHA1

f7921a954a5af85457f6a0e64bb5ee0caf498d68
SHA256

fbd2fc91df25ccd0bb980ee37e092fafa2a2c63d659a98565684006a9e8f72ac
SHA512

d97de52d7831a195358186f81bf318a8931f5e1ead55b2ad760dde876074c003cb933a6470a52830d377d3fbace1cc4f2b9a58a172180661495027713cec9f3f
SSDEEP

768:32AEFF9IXfj87OB16z9lgOIGp9qocLYQYP1V8Ahz+R/X9E7WBOa:GPFFarkOB1MNIGm/kpXmRv9n

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\purim-0-311-0-409.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1640-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download