af4fc7a1f4d6ebea7eeb15f584e84af31b5c0b15c53dafacf1d069731963b1c4

Analysis

max time kernel
1561s
max time network
1562s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 18:11

Target

antA_bump.jpg
Size

318KB
MD5

18a72001b9043aa1dcd0471e1c3f79f0
SHA1

8614f3ff60027912dbf4a3c8775b6504a381342f
SHA256

af4fc7a1f4d6ebea7eeb15f584e84af31b5c0b15c53dafacf1d069731963b1c4
SHA512

1d3a27305533bd5f5fe401f380936475055128a24c5e09d7a87320c4858a3c424b0f6f2dc9555598ebf1dee8ff1d351c9720e39c93440f2dd508fbdc963e0679
SSDEEP

6144:ze4jYM6hiZE9xguZYcvTvgvXFdGVTfqEdh4ifCywWPP74VW04iy+CLp0FMeZrkBr:zjYMkZxguZvv8vfGVTfqEUGCyXcPFmpN

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid	Process
2720	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rundll32.exe

pid	Process
2720	rundll32.exe
2720	rundll32.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2720-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2720-1-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download