1a70915f0169d0a92414ae58337809372ed09b75f877fc570e905abe83d50550

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
31/12/2022, 19:55

Target

Roboto-Bold.ttf
Size

163KB
MD5

b8e42971dec8d49207a8c8e2b919a6ac
SHA1

62442a18a9fe9457c1afeabf683d263a691b7798
SHA256

ec685a46105296fe46c8744da4a11cf8118ba6c11271941766f7a546df6aa7c7
SHA512

3bd40ac788d44626fd640ec67ef04ab0364816b5e8c831f2077bff8805cfe6890ca29274b476f933f6e96ddaa16f4e2f3f66c616dff7cd88cdcaff7dae8ca5e5
SSDEEP

3072:VBa9dX3CyiSB1/R7O0aXjC1YHeA9bOuPUPT9mYZK9K4N09PJ4X4HXYXXXXXXLnqT:uX6XiuMPT/eK9cnfST80/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1908	1348	cmd.exe	29
PID 1348 wrote to memory of 1908	1348	cmd.exe	29
PID 1348 wrote to memory of 1908	1348	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-Bold.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-Bold.ttf
  2⤵
  PID:1908

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1348-54-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp

Filesize
8KB

Download