8a30778288d5c28cfcfdc8811153b9ef192da7e65f6614432d37e1898cd8b7a3

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

game/gui/namebox_big_ru.png
Size

3KB
MD5

ed6ce41a0d3668379e84a252b667cc0d
SHA1

402dc9ba6c1d06f15f45cbefb797d522e0575078
SHA256

0c07ccf016fabba1bfdd333d40332c3fd27e159fd529a3fcc8dbe99f464cea24
SHA512

9dc44b9a73429615de881f30bf7f65e0c6d47bd53cbe15c345bfd590bb7ace196c1870d48630d2d476d6b4642458bb334a5d9409370bdca8068c919d360b63e2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2124	rundll32.exe
2124	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\game\gui\namebox_big_ru.png
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2124-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download