f63c11b91a40c781faf23ac0bb9dfeec1dacd2e6deae21eafd31535af7a8a41c

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image011.png
Size

724B
MD5

b3a180da3cd74bd02bb154a3b8c40e9b
SHA1

bc0fe94ead135a77f72eef073792bee2f3d0547a
SHA256

346a8e3446d0cff56fcab41ca0a4aa71ede2761f80dd2996210b120df7a174d5
SHA512

1555163c058f8ece9d3966bcca470c752b648b9e57b890e005d40e0124f3beede9f9233e6549774ce2fe786009af9c6011e352b2db7bebfc2fec693ecac9c1c2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1168	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image011.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-0-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/1168-1-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download