db59016c1553b720aa0888258a4a115edbec227806933c81c819e37be2ce7610

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hi-tech-abstract-background-cityscape-of-skyscrapers-horizontal-MTXCH6.jpg
Size

390KB
MD5

725ba52c91a2db44c0ba9eca5084c16f
SHA1

128a8567ff75a1bdcba85dfacb4deda48d4bce96
SHA256

db59016c1553b720aa0888258a4a115edbec227806933c81c819e37be2ce7610
SHA512

6448d664285942179e0d3648ab67474478eacbb7c5ed65f4086abe6c22e83009a929d3fe2dd17edad8eb81333b20c8bccee987bcfd070ff0383ab8e94d6d50e0
SSDEEP

12288:BvEHRm+quFbxv2L8qh2uJ3WseqVgrzaHOzV:5kY+qSxDE2uJ3Wrwu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2384	rundll32.exe
2384	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\hi-tech-abstract-background-cityscape-of-skyscrapers-horizontal-MTXCH6.jpg
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2384-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download