d3ac941ab8478e215af35976da2212f5ecb6d87de08b24efb37280b10db8b748 | Triage

Analysis

max time kernel
75s
max time network
80s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07-07-2023 19:29

Sharing

Report Analysis Logs

General

Target

Roboto-Bold.ttf
Size

159KB
MD5

36b5bab58a18b9c924861a4ccbf1a790
SHA1

d313ab2c45756bf4e972647f5b2ad691ad250990
SHA256

24571503140760240924dcd1238f77e7cd0454c0d8b0793990cefa2fad71471f
SHA512

2b8fd5bd0877926b1d7b31908f9632ea4830faa60dced49506f9fc3e43a1f6abe86c6e7360ff190411527deb2347b6191702c1c37bd541e5e0570b722fa7b0bb
SSDEEP

3072:K00P+GU8cnHJ4bNt0ji9U4Rkd8cuyka/ghJZBW4S9QNcJSPxRL72tkYBJa21U:K00Pp19xY/UAtzS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1800	2396	cmd.exe	29
PID 2396 wrote to memory of 1800	2396	cmd.exe	29
PID 2396 wrote to memory of 1800	2396	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Roboto-Bold.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Roboto-Bold.ttf
  2⤵
  PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads