707e4c6d5d57fe10d244fd24f57943ac4bd01f575cafa82dcacba9ce1ca6700e

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/05/2023, 16:03

Target

NodeBeamEditor/bin/html/fonts/glyphicons-halflings-regular.ttf
Size

44KB
MD5

e18bbf611f2a2e43afc071aa2f4e1512
SHA1

44bc1850f570972267b169ae18f1cb06b611ffa2
SHA256

e395044093757d82afcb138957d06a1ea9361bdcf0b442d06a18a8051af57456
SHA512

2b066e06506ef20d69698d37cdec552176ef3f64a1151a99a1d02d72d39ce12c4ff616dc08aafb2ccaea12efd7a1f46b701516a559e5690c57a34b1276e88226
SSDEEP

768:zQsuPjGID9CusBMDgvWZGf2ULAaNnjUIfeRmfFD1iqAzzcZyLwe2pMnIZs9sz/i:8lDYtJWZGOEAaN4I+wD1iqAvcUMe2an7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 840	1920	cmd.exe	29
PID 1920 wrote to memory of 840	1920	cmd.exe	29
PID 1920 wrote to memory of 840	1920	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\html\fonts\glyphicons-halflings-regular.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\html\fonts\glyphicons-halflings-regular.ttf
  2⤵
  PID:840

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact