0c326808cca3c22e43504dd18cde27e25dc7849d8d053fac2fb392f56e15e178

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 05:34

Target

Browser/fonts/NotoSansBassaVah-Regular.ttf
Size

7KB
MD5

778376d22591a4a98bf83ac555ddf413
SHA1

608172ca18450b4cc61ff6cc155f66cff55c5bf9
SHA256

8218239377452e05634a91ee8a4338daf0aa96a15673a437533a098eb9c06f53
SHA512

e895a03374a3d3da04554cd048191722652ed4f1f7cc91639354843138ce26aea6c7f2da0ecda47eb76bcdd61a0315cc2e35e080a5953c24d82f4e94ce4aa260
SSDEEP

192:SUSro5KGKl8Td+FRoUQMpkA3SAROJFpMlce5TcRpc+98FE2J6DZu/njg5G:SUSskkoXo4pkA3SAQs0MJAcg5G

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2168	3048	cmd.exe	32
PID 3048 wrote to memory of 2168	3048	cmd.exe	32
PID 3048 wrote to memory of 2168	3048	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansBassaVah-Regular.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansBassaVah-Regular.ttf
  2⤵
  PID:2168

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact