045f769467d6b2ae5a984ed4ce7487c7c5568bf10db8d36a0118eaa99f46b2e7

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/modern-install.ico
Size

210KB
MD5

9f49cd02b213aec852ace2f045cfab18
SHA1

2624aaa927e45440656d9744f0c13ae53a94becb
SHA256

ced6bd38e3b6731ddf63ed4e5e41d11d9935e220addd0a2d798ce2b7ada8d394
SHA512

185b0066a3de7fc1b2b42670c2d42df3449cf16326629b9925f88181d7c590d73fb5bd94eeeaf8962a3406a65059de8c4edab01503d373986b719bed4f371476
SSDEEP

3072:wD2vb3PtA9/hdTqQfn+oyCRpT6iaA7MZL4JWzFsU5UXV+b5hIS4S9EHf:UM7FO/Tl+oyCRdrbMpaWzF5UXV+bluHf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2568	rundll32.exe
2568	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-install.ico
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2568-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download