1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Target

Roboto-MediumItalic.ttf
Size

169KB
MD5

c16d19c2c0fd1278390a82fc245f4923
SHA1

b3aa2d8f16d5a331fdced82f213a052b204eaca0
SHA256

d3f317c97f4003892cb969bcfce8de3dc9d67fbf96fdafa68b2e3595317b0d94
SHA512

2ba64f250996058e240ef2cc4505c42e5d8abad8f71e40564341e8645d0306fb001a387c827a9bf2a8ef0c191a2d87d71e07665ac62c5c0460a26ce02d375863
SSDEEP

3072:s7Q/lat81psQ7coxhFT5vs42tvbQlybGwGzvh4PZ8zVCmqdhASD/80/:sKIMcsUNvbkyFZWVNfST80/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 556	1732	cmd.exe	29
PID 1732 wrote to memory of 556	1732	cmd.exe	29
PID 1732 wrote to memory of 556	1732	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-MediumItalic.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-MediumItalic.ttf
  2⤵
  PID:556

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1732-54-0x000007FEFBB31000-0x000007FEFBB33000-memory.dmp

Filesize
8KB

Download