d4457d9d3bb89b2395e6c841ddefada9bb067bcf51fc75bb4413d57d87b7a7cd

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-02-2024 12:42

Target

notepad.exe
Size

1.2MB
MD5

5af6de4390ba17649fd55624e4a2d73e
SHA1

14fac7492a1426b49ea716f8f81e5cc1c581ee3f
SHA256

d4457d9d3bb89b2395e6c841ddefada9bb067bcf51fc75bb4413d57d87b7a7cd
SHA512

a30d4733be3e79852f8b96f2a975c852f259ec2d6a9b8bbc774e3492bdce749e11574a7d26743603dbad76d8c34ae9863de7944fa1ba2db6b2e0a6b6257a85eb
SSDEEP

24576:21zx6qnt0RVEyxHFply0jM3azzHsAt+3lkZ8h/vBjGSLBrnAE:21z4q2R/NysLYBVLJnR

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\linedraw.ttf	notepad.exe
File opened for modification	C:\Windows\Fonts\linedraw.ttf	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\notepad.exe"
1⤵
- Drops file in Windows directory
PID:2424

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact