894cb6fb645da94f89bcc803eaa62cead0d87980eb370cf4f99d09fb75b8d084

Analysis

max time kernel
299s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProDinamic.ttf
Size 311KB
Sample260517-qs8tkacw7q
SHA256 894cb6fb645da94f89bcc803eaa62cead0d87980eb370cf4f99d09fb75b8d084
MD5 447d1c29b6910c19c65346bd1a6d8997
SHA1 089a48bf3cfdd3bd24cf8b115198aaba172df609
SHA512 35bc5d39c0d8365a714cd4a5abb16fbf1ddc0cf486a229363bc6b2788434c2b128a163088eddc65f1806e29fdd54dd1a434029a1c803e35139c8126fc2b967ba
SSDEEP 6144:Fst8BzrCwy9r3bcL3pTHGp4t4UqB7msYL2nbvl4Omty:FKUzWwS7bctGpshq9S2nbvl4dty
TLSH
T125649E5BE3B7570FD7202B358970E765B31CBB499B11837B2B092D98ACD98D88F15232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3052	4900	cmd.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProDinamic.ttf
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\ProDinamic.ttf
  2⤵
  PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ProDinamic.ttf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Fonts\ProDinamic.ttf
Size 311KB
SHA256 894cb6fb645da94f89bcc803eaa62cead0d87980eb370cf4f99d09fb75b8d084
MD5 447d1c29b6910c19c65346bd1a6d8997
SHA1 089a48bf3cfdd3bd24cf8b115198aaba172df609
SHA512 35bc5d39c0d8365a714cd4a5abb16fbf1ddc0cf486a229363bc6b2788434c2b128a163088eddc65f1806e29fdd54dd1a434029a1c803e35139c8126fc2b967ba
SSDEEP 6144:Fst8BzrCwy9r3bcL3pTHGp4t4UqB7msYL2nbvl4Omty:FKUzWwS7bctGpshq9S2nbvl4dty
TLSH
T125649E5BE3B7570FD7202B358970E765B31CBB499B11837B2B092D98ACD98D88F15232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download