Edit tour
Windows
Analysis Report
7ASw97uLwOWnId-4R23XxVbAzQ0mid1ESUy4KWXADfo.png
Overview
General Information
| Sample Name: | 7ASw97uLwOWnId-4R23XxVbAzQ0mid1ESUy4KWXADfo.png (renamed file extension from none to png, renamed because original name is a hash value) |
| Original Sample Name: | 7ASw97uLwOWnId-4R23XxVbAzQ0mid1ESUy4KWXADfo |
| Analysis ID: | 1345563 |
| MD5: | 7af523383a67d75244440dfab4a416c5 |
| SHA1: | 1b141ccf3958391f48ed0178c2fe1dd144597812 |
| SHA256: | ec04b0f7bb8bc0e5a721dfb8476dd7c556c0cd0d2689dd44494cb82965c00dfa |
 | |
Detection
| Score: | 1 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 60% |
Signatures
Queries the volume information (name, serial number etc) of a device
Creates files inside the system directory
Classification
Analysis Advice
| Sample is a picture (JPEG, PNG, GIF etc), nothing to analyze |
| Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior |
- System is w10x64
mspaint.exe (PID: 7040 cmdline: mspaint.ex e "C:\User s\user\Des ktop\7ASw9 7uLwOWnId- 4R23XxVbAz Q0mid1ESUy 4KWXADfo.p ng" MD5: 986A191E95952C9E3FE6BE112FB92026)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact | Resource Development | Reconnaissance |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Data Obfuscation | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Abuse Accessibility Features | Acquire Infrastructure | Gather Victim Identity Information |
| Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Rootkit | LSASS Memory | 1 File and Directory Discovery | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | SIM Card Swap | Obtain Device Cloud Backups | Network Denial of Service | Domains | Credentials |
| Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information | Security Account Manager | 11 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Steganography | Data Encrypted for Impact | DNS Server | Email Addresses |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
