1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Target

Roboto-LightItalic.ttf
Size

169KB
MD5

5788d5ce921d7a9b4fa0eaa9bf7fec8d
SHA1

6e01f9df9449565697032b002706a94b51862bbe
SHA256

a48406226854d34fe99642a524a43b2fd26a7dbeca802d5100a8a98d20e1b73d
SHA512

34303ceac62820df18bb40c8b2c39bd7aabd61b962352fcd744f3cfcf77df3639d2b06bf31f44ecc3d1579722ac598d973649648bece568ece6e80f884b79196
SSDEEP

3072:Eslhg2mSacwEH6c96KpVDWH1/XH15O8IdcNuHWjUsM1mCUMESkPIsOp1CboIRJ95:Egm5M6mDAaqxd9pU0WUMxNE/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 960	1884	cmd.exe	28
PID 1884 wrote to memory of 960	1884	cmd.exe	28
PID 1884 wrote to memory of 960	1884	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-LightItalic.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-LightItalic.ttf
  2⤵
  PID:960

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1884-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download