3797d33045461d3f38719dc5a2c226a8163dc06ac0b75c2a93c54ab91f0efb5b

Analysis

max time kernel
368s
max time network
430s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15-04-2023 12:36

Target

res/Fonts/Hack-Bold.ttf
Size

379KB
MD5

81ca1b338503c538de1aef5b1a05167e
SHA1

69f032eb469c750c28398faab2f04925d154886d
SHA256

81d46ebd3b8c64e0f846106c58e6ab008331da5563a3e5dd0f9b0c1d69b5d48e
SHA512

cbf60fef896a35044615ac92d129405086fc9fd582c5dc6465dfd1a679699d516a7c9246e44912959ea2e88e52ea48888852a36a2e9a73a3c363ac30091c1d18
SSDEEP

6144:Lnv6ahqvFaS9+va+ClLoH75WPjNiwv132vj8dS49ed/hf4/3bZ:LnvKvFaS4vdClUH75WrNiwv132vjeSNs

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings cmd.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 2572 wrote to memory of 4064 2572 cmd.exe fontview.exe
PID 2572 wrote to memory of 4064 2572 cmd.exe fontview.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings	cmd.exe

description	pid	process	target process
PID 2572 wrote to memory of 4064	2572	cmd.exe	fontview.exe
PID 2572 wrote to memory of 4064	2572	cmd.exe	fontview.exe

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\res\Fonts\Hack-Bold.ttf
2⤵
PID:4064

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact