f7257e3aa7b2bcf80941949f5db1f62d98376201e395900bfc092c698345e264

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-08-2023 12:08

Target

Fastrace-YzXKj.ttf
Size

26KB
MD5

e6073861d35f6de305360d62b1fe21c8
SHA1

d352c520275fb11cdef7fbe2ce5b7b4671d251f9
SHA256

cec75230ef191e69bafe602d5fbf1656546cd6b2717db3e85702d1234819d0f0
SHA512

cf351e44ae0d87f43e5195d6bf44d5daa31cb18815ce66c7569cf8a14e93a965f82a87ec17cc877b4074338c55614737ee41f5b67811fd879b68ae4ce2724dee
SSDEEP

768:O4PQIHl1nCQlbt9u4Qs5SXim93MN0VJcbrwMfLv:F7CQlb15SymnnqxfLv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2860 wrote to memory of 2912	2860	cmd.exe	fontview.exe
PID 2860 wrote to memory of 2912	2860	cmd.exe	fontview.exe
PID 2860 wrote to memory of 2912	2860	cmd.exe	fontview.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Fastrace-YzXKj.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Fastrace-YzXKj.ttf
2⤵
PID:2912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact