d6bf773a6a466a0107b90a45599f25f11ffb4ef064a5bda57581bdf03f872ecc

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 03:04

Target
update/TBoGT/common/data/fonts.dat
Size 10KB
Sample260528-dkrh4ags2y
SHA256 d6bf773a6a466a0107b90a45599f25f11ffb4ef064a5bda57581bdf03f872ecc
MD5 ad23ac0966de56921f514455cacebcfa
SHA1 2775342ce31ed026d0a3382bb21db1a2469f1e19
SHA512 be05e0eadf8c927d985b6f64e7d88cb42ad2ae6482cdc2ab0704d1cbc8ab27ddad2fbb5eb85f829a640862240832a4bbe8932b5e0fd18eaaf3979d3378bcb317
SSDEEP 192:HXTz03h+xO7DMaKH8PEebXFlGpuw19bD0irQ0Wu6trEom17kyPmuLC1WvzO81wUb:Dz03h+xO7DMaKH8PEebXFlGpuw19bD0o
TLSH
T11F22308C268EE1492331D3F457AA96C4830CC3BA1C27495779DF9BF0230EE35E79544A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4448	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\update\TBoGT\common\data\fonts.dat
1⤵
- Modifies registry class
PID:2756

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact