c00c780ab99e3f252d7ccc2d0d70c43cc16c2a956e8cd9b0bdd16d18f6a90b84

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
08-11-2023 13:05

Target

Ionicons.ttf
Size

432KB
MD5

6148e7019854f3bde85b633cb88f3c25
SHA1

86e07c3d974eb09099e6e5a9b3b8310303cf0feb
SHA256

9c7fb9071a6c28582c6b84468cbff2c7a71e02b17e3a3b4548a159938d22916b
SHA512

2073f3b5e26bb9a3c52fdd82a0f2c0a4f086217c274ee5738f175cc9583a8f75ebb05b43cbae539e32618e2ddf22abd028282b101a1b52345d2b74e54ef2b2cf
SSDEEP

12288:jmgnFw1x1Z97mn2Oe1PDhdksw+kALOvPBpg/Z/DIsZ/mhbbEa:CIwtZ97mn2Osb7kt+pKH0/ZrIswhfEa

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2316 wrote to memory of 2908	2316	cmd.exe	fontview.exe
PID 2316 wrote to memory of 2908	2316	cmd.exe	fontview.exe
PID 2316 wrote to memory of 2908	2316	cmd.exe	fontview.exe

C:\Windows\System32\fontview.exe
"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Ionicons.ttf
1⤵
PID:2908

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ionicons.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2316

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance