05ec45735db9d58d3991941cff56d25ba6ae26dd300b2c1250aca093e68843d1

Analysis

max time kernel
142s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base_font.ttf
Size

54KB
MD5

77171d8f5b5283f9d47a3434704bf944
SHA1

74c87f67010f63777e33c5114c76b1fc67e4ae5b
SHA256

b5b3eb8e443fe9e3976dedaa2650d68d37d992c4e4e2e7676674a1f3027e2a41
SHA512

ebd772c548bd863dd9f9c112acdc5b4ca4aa645866ec2ccf96bd0ec7e77fe165c393bafc18aeb143b14b4bf945c2586656b53b36bf79184381109655bb2bdeca
SSDEEP

1536:8dff4+NKCvJfrhCo+yvTwUnlPx5428MWyH40oM/:8dfQr0frhCQx5t8g4tO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2260	884	cmd.exe	87
PID 884 wrote to memory of 2260	884	cmd.exe	87

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\base_font.ttf
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\base_font.ttf
  2⤵
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads