3797d33045461d3f38719dc5a2c226a8163dc06ac0b75c2a93c54ab91f0efb5b

Analysis

max time kernel
383s
max time network
448s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15-04-2023 12:36

Target

res/Fonts/Hack-Regular.ttf
Size

358KB
MD5

4fea277591543c1fd64a9cf06ec5803a
SHA1

057059d5f04113f1a08bd497c7e85b9bb201305e
SHA256

5378d08507b7259f2762bfec2a98109d2d9c4dd4ab0ffdb994b220856f75f8f8
SHA512

67f4c3354ef0867105d4ea816106633d94d2c0141d8cf3c2b52954aaca05c8a10e06c9b9bef4c7314044827ed8a8d9ab42f41c5f8cc9f1d0175ff3d7cf3d8bb0
SSDEEP

6144:ZztHGROjtxcbN4F2qHw1zZrX/qTFjCSv+Pj1Pwes8CgBmVPJTsOWNwdAyYRWZ:ZztHGROjtxQU2qHWZyTFjJv+RIz8CgQ5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings cmd.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1316 wrote to memory of 1852 1316 cmd.exe fontview.exe
PID 1316 wrote to memory of 1852 1316 cmd.exe fontview.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	cmd.exe

description	pid	process	target process
PID 1316 wrote to memory of 1852	1316	cmd.exe	fontview.exe
PID 1316 wrote to memory of 1852	1316	cmd.exe	fontview.exe

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\res\Fonts\Hack-Regular.ttf
2⤵
PID:1852

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact