Analysis
- user interaction
yes - max time kernel
92s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 14:50
General
- Target 202601221834_172.30.5.41.pcap
- Size 15.7MB
- Sample260415-r74ntsat3k
- SHA256 ce164b00911b2f169a0aacf54bf4925d30d2e813c38d28092aecadd0af68f390
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\202601221834_172.30.5.41.pcap1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExitSplit.MTS"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4352-1-0x0000025B830C0000-0x0000025B8315E000-memory.dmp
memory/4660-0-0x000002107ADF0000-0x000002107AE21000-memory.dmp
memory/4944-33-0x00007FF88D350000-0x00007FF88D375000-memory.dmp
memory/4944-27-0x00007FF8953B0000-0x00007FF8953CA000-memory.dmp
memory/4944-8-0x00007FF895FD0000-0x00007FF896004000-memory.dmp
memory/4944-13-0x00007FF895E90000-0x00007FF895EB2000-memory.dmp
memory/4944-14-0x00007FF895620000-0x00007FF89564B000-memory.dmp
memory/4944-12-0x00007FF89BB40000-0x00007FF89BB59000-memory.dmp
memory/4944-11-0x00007FF8A0310000-0x00007FF8A0321000-memory.dmp
memory/4944-17-0x00007FF896490000-0x00007FF8964A1000-memory.dmp
memory/4944-18-0x00007FF895240000-0x00007FF895312000-memory.dmp
memory/4944-19-0x00007FF885950000-0x00007FF885BE6000-memory.dmp
memory/4944-21-0x00007FF885770000-0x00007FF885853000-memory.dmp
memory/4944-22-0x00007FF8955D0000-0x00007FF895611000-memory.dmp
memory/4944-6-0x00007FF730E30000-0x00007FF730F28000-memory.dmp
memory/4944-34-0x00007FF87E3E0000-0x00007FF87E625000-memory.dmp
memory/4944-7-0x000001D1A0A00000-0x000001D1A0A31000-memory.dmp
memory/4944-30-0x00007FF885560000-0x00007FF88576B000-memory.dmp
memory/4944-32-0x00007FF88E470000-0x00007FF88E4BF000-memory.dmp
memory/4944-29-0x00007FF894B30000-0x00007FF894B41000-memory.dmp
memory/4944-28-0x00007FF895160000-0x00007FF895171000-memory.dmp
memory/4944-31-0x00007FF8854C0000-0x00007FF885558000-memory.dmp
memory/4944-26-0x00007FF8954A0000-0x00007FF8954CD000-memory.dmp
memory/4944-25-0x00007FF8954D0000-0x00007FF8954F6000-memory.dmp
memory/4944-24-0x00007FF895FB0000-0x00007FF895FC8000-memory.dmp
memory/4944-23-0x00007FF895520000-0x00007FF89554F000-memory.dmp
memory/4944-20-0x00007FF885860000-0x00007FF885948000-memory.dmp
memory/4944-16-0x00007FF89BA30000-0x00007FF89BA44000-memory.dmp
memory/4944-15-0x00007FF885BF0000-0x00007FF885F80000-memory.dmp
memory/4944-10-0x000001D1A0A60000-0x000001D1A0A6C000-memory.dmp
memory/4944-9-0x00007FF886970000-0x00007FF886C26000-memory.dmp