0c326808cca3c22e43504dd18cde27e25dc7849d8d053fac2fb392f56e15e178

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 05:34

Target

Browser/fonts/NotoSansBengali-Regular.ttf
Size

198KB
MD5

7b5138efef2c02dda9cfae9917cd913f
SHA1

b44b58f354c4a68e119df226f01ad763b2d1025c
SHA256

9f8b4dd091f19b111d24ea18daae81bea8684cc67de17ea1acd797e144bf20ba
SHA512

47e4cfd2218c91080fc4ccc3ac13dabe9efb7c96b981d53577177fb062973b9fad0052edcf2b0c663ff3b7a1d9e38e96586c93cb72618d64344b96e3df13204c
SSDEEP

6144:JVh9sfLfq0/WUqPyHy/4EXBtTYn4myGmyd1cCbflj2zdrSubYXmdXKOtZ:Jr4Lfq0/WUqPyHrExtTYn4myGmyd1cCu

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2012	648	cmd.exe	31
PID 648 wrote to memory of 2012	648	cmd.exe	31
PID 648 wrote to memory of 2012	648	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansBengali-Regular.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansBengali-Regular.ttf
  2⤵
  PID:2012

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact