c00c780ab99e3f252d7ccc2d0d70c43cc16c2a956e8cd9b0bdd16d18f6a90b84

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
08-11-2023 13:05

Target

Ionicons.ttf
Size

432KB
MD5

6148e7019854f3bde85b633cb88f3c25
SHA1

86e07c3d974eb09099e6e5a9b3b8310303cf0feb
SHA256

9c7fb9071a6c28582c6b84468cbff2c7a71e02b17e3a3b4548a159938d22916b
SHA512

2073f3b5e26bb9a3c52fdd82a0f2c0a4f086217c274ee5738f175cc9583a8f75ebb05b43cbae539e32618e2ddf22abd028282b101a1b52345d2b74e54ef2b2cf
SSDEEP

12288:jmgnFw1x1Z97mn2Oe1PDhdksw+kALOvPBpg/Z/DIsZ/mhbbEa:CIwtZ97mn2Osb7kt+pKH0/ZrIswhfEa

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2908	2316	cmd.exe	1
PID 2316 wrote to memory of 2908	2316	cmd.exe	1
PID 2316 wrote to memory of 2908	2316	cmd.exe	1

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Ionicons.ttf
1⤵
PID:2908

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ionicons.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact