cdee4ef31a7a0ef1db81e48b0bdd572152a533bbb8ad995ab5b0a7fc3d1c004c

Resubmissions

01-07-2024 06:49

240701-hld2lssajr 3

01-07-2024 05:24

240701-f3xh6s1arj 8

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RobloxScreenShot20240212_150244181.png
Size

192KB
MD5

3064c2cbca1e6bea94ac1923783f2e14
SHA1

7a5b15e03a15b9c43b04e5cd9b31432ba57680f4
SHA256

cdee4ef31a7a0ef1db81e48b0bdd572152a533bbb8ad995ab5b0a7fc3d1c004c
SHA512

883cc188c17b6d557b926c0f5e3f22346f04a6e44ac2a6b0c0a2131731c8e8756cef8188da7f0c80d33952fcb8595dc1f0a49ba41d7436f8c030fec8915649ab
SSDEEP

3072:IzMRgSef0N8zW5tO41GlOaWkf91BNtw4/JDYohWicn/eqT4iam5sEt2FkHEAZ:IYySefQ35tzUPBNl/lYUdQ/ram5FE+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

rundll32.exe

pid process

1176 rundll32.exe
1176 rundll32.exe

pid	process
1176	rundll32.exe
1176	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\RobloxScreenShot20240212_150244181.png
1⤵
- Suspicious use of FindShellTrayWindow
PID:1176

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-0-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download