Resubmissions

29-05-2023 01:11

230529-bj2assha72 10

27-05-2023 19:22

230527-x3jqrach68 10

27-05-2023 19:19

230527-x1ph8adc8s 10

06-05-2023 03:47

230506-ecc66sab7y 10

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    27-05-2023 19:22

General

  • Target

    AndroidClockMono-Thin.ttf

  • Size

    5KB

  • MD5

    865726afe8b0b3e604da03819a4573bf

  • SHA1

    9c32d4dccb41b1405677f26aecfaefba33f9fd81

  • SHA256

    36b8ff47ed75e57f3a4268d3733f80156aec8f92265ef0a48516f21454098222

  • SHA512

    16bfee3afc9e9d7e910cc79405b3ad1ad90dea534035df75a81fe17a51e49945cf48d7fc37823e43504dd8810d96313054583c04e695522954bceac57feb86d4

  • SSDEEP

    96:u639wRWDqUIy5nlQVZWgTtT00suKlR9ys3Eln1WcDG/0Lhti6G4:h9feynuVJp00FY9Yl1Wcq/0Lhti6/

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\AndroidClockMono-Thin.ttf
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\System32\fontview.exe
      "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\AndroidClockMono-Thin.ttf
      2⤵
        PID:1028

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads