c00c780ab99e3f252d7ccc2d0d70c43cc16c2a956e8cd9b0bdd16d18f6a90b84

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
08-11-2023 13:05

Target

EvilIcons.ttf
Size

13KB
MD5

140c53a7643ea949007aa9a282153849
SHA1

91d377ea3cf47490b256c2ed081704a7dabdae0c
SHA256

a5caeb4d395c5e32f1d5a30acb382aebc664f1badfd149319907f2215e4e3e26
SHA512

90081da193c95239fd2735b710bd019212b3ee545a0d82f756a5cc46e6a04e53b0781c302f9ed2ff3e49b8c72f8233a8ab41c748013f04fc384419d4bc3aa004
SSDEEP

384:29l16YGdU7KcnIXYwmjfj71s6wv35j4eC:2J6YAU7KcnIIwmjfjhpwv3Vw

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2604	2056	cmd.exe	29
PID 2056 wrote to memory of 2604	2056	cmd.exe	29
PID 2056 wrote to memory of 2604	2056	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EvilIcons.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\EvilIcons.ttf
  2⤵
  PID:2604

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact