14ce93ae01d50b9d2ff3c36c3edd574a9f8bcec56451f3a865fcc210c617a77b

Resubmissions

19/09/2024, 06:30

240919-g9r3psvepe 7

19/09/2024, 06:27

240919-g7tthsvdrg 5

19/09/2024, 06:21

240919-g4a71avcma 7

19/09/2024, 06:17

240919-g127bavejl 7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOURCE/ICONS/Logo.ico
Size

156KB
MD5

c383035a57c2e7a39803f71096011ca6
SHA1

28eb06af5b03de330423e40275cfc251ee324d6f
SHA256

71de01801146e8dbe1ea5771a80b5f8e39693a58ad12987022dde335b9d7ca86
SHA512

62f3243857cd4a03f094209da3990c2bbe4f92ae2a4d945f2715cc0d95daf0bc6b821bc0a1e06ddcd86cbf409d9ef2f530116b1e155d2e2f98a5d855342e4796
SSDEEP

3072:bXKRZnDsdyWfB4uZfJybGkbr81fCMGfKCnQY/LWEwIqoqE7U4ubpLEO6uim:bXSZnx8muZ04FPEO9VkHy

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\SOURCE\ICONS\Logo.ico
1⤵
- Suspicious use of FindShellTrayWindow
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download