2682455b3e3ec0906091f044c3d39db809b2f7ccda4c47943411bc7cea356cf2

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PySpy-2.1.1/window.png
Size 16KB
Sample240905-22z4katbkr
SHA256 a892c47d4c03b1bc03dd9fd953e000461dcb4b8d4dca149a95ed2748053f52cf
MD5 b6e5150df552488d0adee83ee05685ac
SHA1 5798c533d951ad8730cb3d89acce255cf237931b
SHA512 3a0a553d9e2d6f1f3a05b04ebfdb65b3c91ea2cbc6f68c09ce55837588950928d9873b55ff52d81e3f3c8bcc0af40ac575b7a1651d5e20e83e6d1aa17ef4053a
SSDEEP 384:iErM2ys+gVZIyOvUa8aiLZTTdgTmE6oIroNDvqF0TQJBvtg0U07LG+:LHwgnOvzMt3eTioMoNOFjJ0uLx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1048	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\PySpy-2.1.1\window.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/1048-1-0x0000000000210000-0x0000000000211000-memory.dmp