1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Target

Roboto-Regular.ttf
Size

164KB
MD5

8a36205bd9b83e03af0591a004bc97f4
SHA1

56c5c0d38bde4c1f1549dda43db37b09c608aad3
SHA256

4e147ab64b9fdf6d89d01f6b8c3ca0b3cddc59d608a8e2218f9a2504b5c98e14
SHA512

e96b43b0ca3fd7775d75a702f44cd1b0dfd325e1db317f7cba84efdf572571fe7594068f9132a937251aab8bd1f68783213677d4953aca197195fbe5db1f90d7
SSDEEP

3072:5y2goL/sAQRuzzlPrvRwhRFUzMWlYfxJVBxV+aYT3qPXI0yH4yDuNOIOU7og2NE/:xOmCeu+bqPeHr0WUMxNE/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1496	1180	cmd.exe	29
PID 1180 wrote to memory of 1496	1180	cmd.exe	29
PID 1180 wrote to memory of 1496	1180	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-Regular.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-Regular.ttf
  2⤵
  PID:1496

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1180-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp

Filesize
8KB

Download