c2ba0018de8dcf0abfb2669cce95ed09377e9a9da7ff8e74e95688c99a025634

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LogoDev.png
Size

23KB
MD5

b8f553fbd3dc34b58bc77a705711023d
SHA1

4ab1052f906fda96f877e398426da5646574c878
SHA256

2761c60263a2919b856915bdd2a0604b7f0e56e59d893ab13cccef2b7c967229
SHA512

15a1df0dbb06b4bb64a2b8cd7ad22578292d5ecdec64303350e027f9f87fa8a825cb1cc97f94862d8c235c85b0c79a4feabfb89d9e0b77be62aab25785122a60
SSDEEP

384:qSVmAf6Ft8Itb+e2b9tdTwEy9kXs6vWZZCbiXSeEO/12Hb40yrWSbN8qtA:qImAfe7gx3y6MZC2CeV2747zbN8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2676	rundll32.exe
2676	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\LogoDev.png
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download