f7257e3aa7b2bcf80941949f5db1f62d98376201e395900bfc092c698345e264

Analysis

max time kernel
133s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2023 12:08

Target

Fastrace-YzXKj.ttf
Size

26KB
MD5

e6073861d35f6de305360d62b1fe21c8
SHA1

d352c520275fb11cdef7fbe2ce5b7b4671d251f9
SHA256

cec75230ef191e69bafe602d5fbf1656546cd6b2717db3e85702d1234819d0f0
SHA512

cf351e44ae0d87f43e5195d6bf44d5daa31cb18815ce66c7569cf8a14e93a965f82a87ec17cc877b4074338c55614737ee41f5b67811fd879b68ae4ce2724dee
SSDEEP

768:O4PQIHl1nCQlbt9u4Qs5SXim93MN0VJcbrwMfLv:F7CQlb15SymnnqxfLv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings cmd.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 1328 wrote to memory of 3880 1328 cmd.exe fontview.exe
PID 1328 wrote to memory of 3880 1328 cmd.exe fontview.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	cmd.exe

description	pid	process	target process
PID 1328 wrote to memory of 3880	1328	cmd.exe	fontview.exe
PID 1328 wrote to memory of 3880	1328	cmd.exe	fontview.exe

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Fastrace-YzXKj.ttf
2⤵
PID:3880

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact