0c326808cca3c22e43504dd18cde27e25dc7849d8d053fac2fb392f56e15e178

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 05:34

Target

Browser/fonts/NotoSansOlChiki-Regular.ttf
Size

15KB
MD5

60968f91c8c0a470a1160b455dab7fdf
SHA1

d53db996fdc556ae506c750b06b0c20decdf37d3
SHA256

4b1ad6ec4a30277c75fd66465b0b9ae489e19f8fdf44ef3179b6fda7f5ceb32d
SHA512

911da3728af8fd4e69af550428d867da12bf3c1a58706ac3d38d66f835e3fee868b16a680372017db668b9d8cbb711b36c3948c8827ff9ba572e065898783b4a
SSDEEP

384:Mjpr8kgMfLfbU2C/pStiEjroGhYwzucMl6gaAYbA1FkjJ4:cr0MfLQ2C/pStiGBhazlYM1Fkj+

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2732	2236	cmd.exe	31
PID 2236 wrote to memory of 2732	2236	cmd.exe	31
PID 2236 wrote to memory of 2732	2236	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansOlChiki-Regular.ttf
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Browser\fonts\NotoSansOlChiki-Regular.ttf
  2⤵
  PID:2732

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact