11c32d9eb9ff7eec5c91cb1151744d91258aeae810d455199cd233cf466537b4

Analysis

max time kernel
361s
max time network
365s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_0883.jpg
Size

264KB
MD5

2631d7f280d0c332241bc816cd858eb8
SHA1

8be7ce9bf6ff23bbf1654c9432557b109caf6113
SHA256

11c32d9eb9ff7eec5c91cb1151744d91258aeae810d455199cd233cf466537b4
SHA512

6e4444bbf46245fb201bb894a6b3bf2543df0b3a3a9ea6ab0ca10aae4838f660071bd6e7bfc0509cbd1f24c1c2bebf0ac0218934bc2b1aef05d13692aaf0c85f
SSDEEP

6144:aTe+sRMtC4470q8UlIt/YZ3feCoV7Hsd/Kv1208pO:2eTRMI4476UedYZ3wMdSd27pO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\IMG_0883.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-0-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/2568-1-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download