1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Sharing

Report Analysis Logs

General

Target

Roboto-Light.ttf
Size

163KB
MD5

881e150ab929e26d1f812c4342c15a7c
SHA1

18788c5d630fa695f9283f6393bfa541b2031508
SHA256

c576c50642271bcdbfffed04f92dc8d6a981daf300914d0a20c8a5a5a57015c7
SHA512

af18febdf3e0d5fc8111e6335bd8cc4fc8dd944910db8a4f3ebae284e3d1064eb793a25588007e3d1cee24051e11cf3328951a3f708375856d54176a53701b49
SSDEEP

3072:BXlLgbEmk0/Dv6QKwRr4T2EUtxq2FquPte/TxDuNOIOU7og2NE/:3qXpSIE6Ey/ux0WUMxNE/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 748	1276	cmd.exe	29
PID 1276 wrote to memory of 748	1276	cmd.exe	29
PID 1276 wrote to memory of 748	1276	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-Light.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-Light.ttf
  2⤵
  PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-54-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

Filesize
8KB

Download