0c326808cca3c22e43504dd18cde27e25dc7849d8d053fac2fb392f56e15e178

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 05:34

Target

Browser/fonts/NotoSansBalinese-Regular.ttf
Size

128KB
MD5

12764d72c2cee67144991a62e8e0d1c5
SHA1

f61be58fea99ad23ef720fbc189673a6e3fd6a64
SHA256

194e110cb1e3f1938def209e152a8007fe5a8b0db5b7ce46a2de6e346667e43d
SHA512

fb670a7dbb57465d6384cd5c3a35356e94bf54ac4cb7578e67c8729ff982943b99c95b57f6059443e3e8b56d8c8d2cfc6e81ae3a1cf07306f91c3a96e4883906
SSDEEP

3072:ppljnZNPA3M93AFT8fTaF9zjN1ymmtHpSTUqTTM:zltZA8KafTErjiJST5TI

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2220	2812	cmd.exe	31
PID 2812 wrote to memory of 2220	2812	cmd.exe	31
PID 2812 wrote to memory of 2220	2812	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansBalinese-Regular.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansBalinese-Regular.ttf
  2⤵
  PID:2220

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact