1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Target

Roboto-ThinItalic.ttf
Size

168KB
MD5

7bcadd0675fe47d69c2d8aaef683416f
SHA1

cc79d5a23bd0ec08b1d99f5390bf33cacc3082f4
SHA256

28ce251a99cd57d00a98225a8fcb66b60b69daf10b0947c7ec4ed503c22affef
SHA512

029bbc2bc659bdeb62a170491b43ee78c6c3d4590f1189339e7abc5706aaa25ec8277fcad46c79f3a0572aba96e11a8bdf7b1c425a8885c752b4254f11705969
SSDEEP

3072:cxPLJllUxyf3JM0SVK24NWg6+aHhQIRTkC5EmQJRDDcc4MAT4UuyONQqjognFwu:QTRF2VKy+aCLHNAT4OVqkIFwu

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1728	2016	cmd.exe	27
PID 2016 wrote to memory of 1728	2016	cmd.exe	27
PID 2016 wrote to memory of 1728	2016	cmd.exe	27

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-ThinItalic.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-ThinItalic.ttf
  2⤵
  PID:1728

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2016-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download