1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Target

Roboto-BlackItalic.ttf
Size

170KB
MD5

c3332e3b8feff748ecb0c6cb75d65eae
SHA1

03d6e3747d862385dbe48e8296385b9236101a62
SHA256

8b2f87fb08ff4b5d62e753c750fe3291813586501fa14dd258b1ad0bfba533ae
SHA512

4a21d4a38704bbb9ccd955a8c336d01b62cc5800e01257252babcecd707313d4af2a1ac98f5e2ac4b23f2f0c72f7b9eac0bf4826cad875a94f7c57c6154f68da
SSDEEP

3072:Ezgv09uYPUi00NM8X17n2RDLvAMMxFo78qFgYVCYw1YCBx8fPmrZL14YZd5idaVJ:Ecvwu3i007zefvAMMxFo7vFVrw1J78fA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 576	1516	cmd.exe	29
PID 1516 wrote to memory of 576	1516	cmd.exe	29
PID 1516 wrote to memory of 576	1516	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-BlackItalic.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-BlackItalic.ttf
  2⤵
  PID:576

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1516-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download