1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Target

Roboto-BoldItalic.ttf
Size

167KB
MD5

fd6e9700781c4aaae877999d09db9e09
SHA1

2f10ad9e8cab0880182705c4e0fbaeabae706e64
SHA256

61df597f73c91f238cbe88fe3c536702d120d048b79b25fa0f4f7818fd123a6f
SHA512

8c9a07c662ceae43dd999872f6bd6916cb95b58c2ae373fd0a8aa58b91ce7c436d4d17d8bb3f87d644dc4362763adab2826a3f7d0f63b555b41eca747e3ea3dd
SSDEEP

3072:JlgZjU+O14f107sBZsOX86LjoqEUZsSSSa+m+b0gWOuLr9CdqdhASD/80/:JOdjHsx5Mw+m+ogKrwdfST80/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 524	1580	cmd.exe	29
PID 1580 wrote to memory of 524	1580	cmd.exe	29
PID 1580 wrote to memory of 524	1580	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-BoldItalic.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-BoldItalic.ttf
  2⤵
  PID:524

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1580-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download