3797d33045461d3f38719dc5a2c226a8163dc06ac0b75c2a93c54ab91f0efb5b

Analysis

max time kernel
383s
max time network
448s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15-04-2023 12:36

Target

res/Fonts/Hack-BoldOblique.ttf
Size

377KB
MD5

820b6dd5201fcda765492f47a51ccc59
SHA1

5f99ac271a95b11d77298db83fc876fb80392c56
SHA256

52c7a88c03f42d5d3c47066b168f1776d2c3fb4764a9039110726cf4f2482d1f
SHA512

a38179b9ea0447c14913b1e026476de466030221ae00d6d6a206735b9282eddc4f93c52af287d00b6e0e6bd9d60f8c573c38e3a58991f50537e58f0eb603188b
SSDEEP

6144:ItY/gBHayJ5ymxk2NMl8S28tDzp238gTEddqt9XSFKvNu1lg5lQZHrIhoJNiwv1c:ItY45yY8tDzrgThXSow1lg5uHrIh8Ni9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings cmd.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3820 wrote to memory of 3860 3820 cmd.exe fontview.exe
PID 3820 wrote to memory of 3860 3820 cmd.exe fontview.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	cmd.exe

description	pid	process	target process
PID 3820 wrote to memory of 3860	3820	cmd.exe	fontview.exe
PID 3820 wrote to memory of 3860	3820	cmd.exe	fontview.exe

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\res\Fonts\Hack-BoldOblique.ttf
2⤵
PID:3860

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact