7bbaf1f1c28c36991a539ae63067b2b202906420d32bd2f3804dba33105a9a13

Analysis

max time kernel
1442s
max time network
1442s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

unnamed.jpg
Size

92KB
MD5

a95d33ae0c382569ce014d7a80eb3045
SHA1

a2036462bab32ec739bd9ea881f1883dfee84f25
SHA256

7bbaf1f1c28c36991a539ae63067b2b202906420d32bd2f3804dba33105a9a13
SHA512

2bede294362c901ae06676f94866a2163359ba98770a11a2a91a12e7680bc728f285fb6fe59112443e0aeabd8a4934b8dea1cf15525a05f6124e3ef671380f53
SSDEEP

1536:1xzEcz1HEDdnCEZBOBxY8N6mud7VKJX8f7/yLALuKoQuA/hKU4o8viuuNksL:bFEdn9TmN20yUHQu2hz4fviBB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1292	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1292	rundll32.exe
1292	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\unnamed.jpg
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-0-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/1292-1-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download