cf19ea62eafe40f5111e2cce3b161b4ba4d3ab4d79e676b2c096152b8ddc185f

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BetterMap/assets/f1_boss.png
Size

414KB
MD5

03617ec3b66f05c8a122c92103fff28a
SHA1

3d3380ff5e7ef5f4eed247403b25f593dd0a977f
SHA256

16dc3f9540ed5ca86aa4a03c583f8b5c9a379f5b8a56d6a9c241c22610e82979
SHA512

3102b856fb9da32867843a911af7b8f842ed24bd0024ec99d9cf51d21c2e95d8f6ec33d2de789b6bca456774f41dc51576805b84ccf4fe40be50aeb66c4c05fc
SSDEEP

6144:WZN+LCdzQBCyREqZtdgjpoRSriYwyzGzxoGwf4KoG2tXzYhQZvFzNJYvh8zGt/+U:WZkudXkZtOjNgd6f44NhQZvbdzICIf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\BetterMap\assets\f1_boss.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/1804-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download