81f39cffba8b45367a21249720782603b852bee71aad710f8f66fec3d3776af3

Analysis

max time kernel
898s
max time network
564s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/08/2026, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Capitalism Lab/font/Noto.otf
Size 5.4MB
Sample260817-gaggxsteqd
SHA256 81f39cffba8b45367a21249720782603b852bee71aad710f8f66fec3d3776af3
MD5 485e33cfac6b276b665e47a08424e3e6
SHA1 1456f6408f8e40158f1f4cdfa2ff263157da1834
SHA512 c249bac1e2962c199472d576b49402f898b20a96ff8fb3104fd0457a6d9063a067d948879594fdd65091ee5f4a7e935362f54037e010bfa88fd9d74378d8af13
SSDEEP 98304:cPOYAiuTsXgBpOm3NBa12mJ3VxceIDHYHHhBhDcrtGVQC4uzukQINdQXgJxZ5BR+:cPO0AsXCpV3NB6NdcdcPhDWtG6MzvdHS
TLSH
T1D24612BD69FC6818C9A7A1323642E53D289A180C989FF0F8E8475F7379D52341F6D782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 704	4660	cmd.exe	85

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Capitalism Lab\font\Noto.otf"
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System32\fontview.exe
  "C:\Windows\System32\fontview.exe" C:\Users\Admin\AppData\Local\Temp\Capitalism Lab\font\Noto.otf
  2⤵
  PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads