b653631708cdf4b2ec872b4dca10f3c23380c7a2b2029e20f23b590602d1bcfe

max time kernel
25s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05/07/2023, 08:41

Sharing

Target

Norican-Regular.ttf
Size

45KB
MD5

3426ee499f815a2ea5a90b1ae7447bf3
SHA1

e74bdc08e742904dcc23e4af44978bcb74a5fa59
SHA256

f8f8988cf7cc2bfa4093c6aa2ff97e4b0e0f3e1e6f64750cc8a94426c646a951
SHA512

ca027a480f62a826ebf416c2b81f581fb17b19fc70fa3e33750fb03d29553fae513e78d742380578bbf201bf2f40a7555b58a5d0fdbfa565aa23601be945cb16
SSDEEP

768:Hdidy5DYCQipTTQuLRBGyKJnZBKA6osTCDjzDAW5b9k6gGzVfj5DazMMditIP0Pj:4dMlfQuLnGxPdsTCDj1puGTPIP0Pge

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1336	1804	cmd.exe	29
PID 1804 wrote to memory of 1336	1804	cmd.exe	29
PID 1804 wrote to memory of 1336	1804	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Norican-Regular.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Norican-Regular.ttf
  2⤵
  PID:1336

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact