f63c11b91a40c781faf23ac0bb9dfeec1dacd2e6deae21eafd31535af7a8a41c

Analysis

max time kernel
16s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image014.png
Size

751B
MD5

aa8ad64de30c179867f55872fdc46ba0
SHA1

08a82262ba9cf584430c7864e4eab7391d45e305
SHA256

15538f33f67c188e4fef67040cf0e343bfdcd12c1b03c18ebe1c3ea855119b41
SHA512

02bfd93c089de5b1c6536e9f625ba2e575a275acb929309d37fb327a3faa9e1fdb84497a9c3119d1e42a4404675e26b38da2fc0fa81e7c63e1745cb39893abbb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\image014.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1820-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download