875655906f4b3f03040c9137a6e772418558c210a036c9e28e0873e3bd467eec

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
17-10-2023 15:30

Target

EvilIcons.ttf
Size

13KB
MD5

140c53a7643ea949007aa9a282153849
SHA1

91d377ea3cf47490b256c2ed081704a7dabdae0c
SHA256

a5caeb4d395c5e32f1d5a30acb382aebc664f1badfd149319907f2215e4e3e26
SHA512

90081da193c95239fd2735b710bd019212b3ee545a0d82f756a5cc46e6a04e53b0781c302f9ed2ff3e49b8c72f8233a8ab41c748013f04fc384419d4bc3aa004
SSDEEP

384:29l16YGdU7KcnIXYwmjfj71s6wv35j4eC:2J6YAU7KcnIIwmjfjhpwv3Vw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1456 wrote to memory of 2776	1456	cmd.exe	fontview.exe
PID 1456 wrote to memory of 2776	1456	cmd.exe	fontview.exe
PID 1456 wrote to memory of 2776	1456	cmd.exe	fontview.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EvilIcons.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\EvilIcons.ttf
2⤵
PID:2776

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance