Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 08:01
General
-
Target
Orbit/Zappericons-Regular.ttf
-
Size
3KB
-
MD5
6171764d98cd619bc54dff71fbdb646b
-
SHA1
578f0ae0a40c66950a87a76cc020ab22d5008288
-
SHA256
3c5f8071d0897b8c0dd694704b1cc4c051609c98a154e88a088e8e9ccf2fa56a
-
SHA512
52a35bde5e17f5d79fcf449b8c71243e7d51e6c984a54ae4058d460ce8bd6c4b55f474ee486e5a7fa3ddd2a9a5ced47ccd58dbd2011010d98fd69cf183f63b48
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Orbit\Zappericons-Regular.ttf1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fontview.exe"C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Orbit\Zappericons-Regular.ttf2⤵
-