737c8aa1e9a435f9a4041a3132ed01595139f5c1cdeff1bc3d3b0ea7b2035aa8

Analysis

max time kernel
1794s
max time network
1818s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 20:14

Target

boredape/assets/fonts/MonumentExtended-Regular.otf
Size

33KB
MD5

73b9994bb505da43a387d107849baf95
SHA1

1e787896f58bb8ef3b6d5276f8c6d8da541150d9
SHA256

62b958648c1a7f8e984788b7f02902d11531f76e481ce0b9043ad53840a72d09
SHA512

97c9ef46ee62423cdbec88ac8e1870120c86536292d234dc3235b9f036aa79897e80e5b63f65e6c700c3ef34192f4b618b348cd60f4758f348b465b6fad077b1
SSDEEP

768:L3wgJKUWGRAsvTz1pc+ldR50nOyRukIL7QnDGKVI8RN50XHPIkWC6wi:DZJK7GRfzMIdR5xKuADGgIa+HgCp

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2616	3040	cmd.exe	30
PID 3040 wrote to memory of 2616	3040	cmd.exe	30
PID 3040 wrote to memory of 2616	3040	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\boredape\assets\fonts\MonumentExtended-Regular.otf
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\boredape\assets\fonts\MonumentExtended-Regular.otf
  2⤵
  PID:2616

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact