d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e.exe
Size 3.1MB
Sample260805-kdq3bashqb
SHA256 d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e
MD5 66fbc067fbe51c242ebb558faa53539f
SHA1 c40ac591739a2b985cab5b49760ff4d9caa45a73
SHA512 2774bba47161c2cc819860ac9662b04dc2edda24355aef1569e19d228311c5f7c5a55f82576c9d45c52c14d98de4ab6cfdd362a6ec2b7bde298a8854aee069d0
SSDEEP 49152:mSmr/RYWGGBT22oNbkzO5ZRUtqNA3Qn1rUkHOFZ5XL2mQ4IU6ipo:EGGVzooOWI89KH+
TLSH
T1A4E55C02BA9B94ECC15AC474C34A4A736E2174CB0726B9FF46D496383E6ABF15B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3172	FontCacheSvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\FontCacheAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\FontCache\\FontCacheSvc.exe"	d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e.exe

C:\Users\Admin\AppData\Local\Temp\d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e.exe
"C:\Users\Admin\AppData\Local\Temp\d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e.exe"
1⤵
- Adds Run key to start application
PID:2776

C:\Users\Admin\AppData\Roaming\Microsoft\FontCache\FontCacheSvc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\FontCache\FontCacheSvc.exe
1⤵
- Executes dropped EXE
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontcache.log

Path C:\Users\Admin\AppData\Local\Temp\fontcache.log
Size 37B
SHA256 0cd43529420727e4c3ed4864f53f9885a2fbe60c324789bd31f0d5e885af3bba
MD5 c1ac53901e6c1d0c21cbef9980649377
SHA1 e1e6f052edb0b7bc08ce310c9c033202fbce225a
SHA512 775547dadb2215a16afb59c0311c355aafdc0bae51f6376e8413ba62f7f9fb3fa50417ff25c9a1e6520fd539698390c27a6deb23e2c5449a499adc4663e69468
MD5 SHA1 SHA512

Submit Download

fontcache.log

Path C:\Users\Admin\AppData\Local\Temp\fontcache.log
Size 95B
SHA256 36e258fec993996f405aa585033b4f7383df5f4b7e69847069650984456a8e4c
MD5 85ea81ebb942a8bf2b95b2b5049d639e
SHA1 2c7dabc419d51409db4b8575a03e40f881a6e553
SHA512 fa4ed9de9faf060f8da4c0b7dfdec13c234eae4b82ef612533b43e090265e65827d20482ce74fbebd5cef76a9410965a4006679e79ecd73db09c836be70d1930
TLSH
T1D5B001E0DC90354D02225421123B14A1E26C3C3B22FFBC0E151182197A247E291C37BA
MD5 SHA1 SHA512 TLSH

Submit Download

FontCacheSvc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\FontCache\FontCacheSvc.exe
Size 3.1MB
SHA256 d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e
MD5 66fbc067fbe51c242ebb558faa53539f
SHA1 c40ac591739a2b985cab5b49760ff4d9caa45a73
SHA512 2774bba47161c2cc819860ac9662b04dc2edda24355aef1569e19d228311c5f7c5a55f82576c9d45c52c14d98de4ab6cfdd362a6ec2b7bde298a8854aee069d0
SSDEEP 49152:mSmr/RYWGGBT22oNbkzO5ZRUtqNA3Qn1rUkHOFZ5XL2mQ4IU6ipo:EGGVzooOWI89KH+
TLSH
T1A4E55C02BA9B94ECC15AC474C34A4A736E2174CB0726B9FF46D496383E6ABF15B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads