3758a12f5571cefe41a15dc64b496df2900df304edc50a2b44c995e868a30dc8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fotosy/head.png
Size

278B
MD5

24506b27a576482a352da70c56152010
SHA1

1865236f269152b48982ab107d207729c8734606
SHA256

aa0947f68f4696c7e554d0244e3c0488520719112ac6a8a6605ade75ada443a6
SHA512

2593e27d4b3c7c24cd56b95d61006c0acd98c0cf371ff375cda35e1c512bfcd2a322dc367b184d97701da7ba4e472ad7df895004a456e63746937c2bc4b0430d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\fotosy\head.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2100-1-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download