Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 16:28
General
- Target recording-1632518357039.webm
- Size 2.5MB
- Sample260415-ty4ctady5l
- SHA256 e3d602a90a8ceef81d09a241cf40ebf4c3db430d3faf11ca547f4e8966c35adb
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 14 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\recording-1632518357039.webm1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\recording-1632518357039.webm"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/556-32-0x0000023A5DA60000-0x0000023A5DAB5000-memory.dmp
memory/3776-0-0x00007FF83A42D000-0x00007FF83A42F000-memory.dmp
memory/3776-1-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-2-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-3-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-4-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-6-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-5-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-7-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-9-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-8-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-10-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-11-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-13-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-12-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-14-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-15-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-16-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-17-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-18-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-20-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-21-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-19-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-22-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-23-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-24-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-25-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-30-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-31-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-33-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-34-0x00007FF6EFCC0000-0x00007FF6EFDB8000-memory.dmp
memory/3776-36-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-42-0x00007FF846660000-0x00007FF84668B000-memory.dmp
memory/3776-41-0x00007FF846690000-0x00007FF8466B2000-memory.dmp
memory/3776-40-0x00007FF84AF00000-0x00007FF84AF19000-memory.dmp
memory/3776-44-0x00007FF846B40000-0x00007FF846B54000-memory.dmp
memory/3776-46-0x00007FF839D10000-0x00007FF839DE2000-memory.dmp
memory/3776-47-0x00007FF839A70000-0x00007FF839D06000-memory.dmp
memory/3776-45-0x00007FF8464D0000-0x00007FF8464E1000-memory.dmp
memory/3776-43-0x00007FF839DF0000-0x00007FF83A180000-memory.dmp
memory/3776-39-0x00007FF84D450000-0x00007FF84D461000-memory.dmp
memory/3776-38-0x000001EE94EE0000-0x000001EE94F35000-memory.dmp
memory/3776-37-0x000001EE94EC0000-0x000001EE94ECC000-memory.dmp
memory/3776-35-0x00007FF8466C0000-0x00007FF8466F4000-memory.dmp
memory/3776-49-0x00007FF839890000-0x00007FF839973000-memory.dmp
memory/3776-53-0x00007FF845940000-0x00007FF845966000-memory.dmp
memory/3776-57-0x00007FF8458D0000-0x00007FF8458E1000-memory.dmp
memory/3776-56-0x00007FF8458F0000-0x00007FF845901000-memory.dmp
memory/3776-55-0x00007FF845F40000-0x00007FF845F5A000-memory.dmp
memory/3776-54-0x00007FF845910000-0x00007FF84593D000-memory.dmp
memory/3776-52-0x00007FF845F60000-0x00007FF845F78000-memory.dmp
memory/3776-51-0x00007FF845FD0000-0x00007FF845FFF000-memory.dmp
memory/3776-50-0x00007FF846480000-0x00007FF8464C1000-memory.dmp
memory/3776-48-0x00007FF839980000-0x00007FF839A68000-memory.dmp
memory/3776-58-0x00007FF839680000-0x00007FF83988B000-memory.dmp
memory/3776-59-0x00007FF8395E0000-0x00007FF839678000-memory.dmp
memory/3776-60-0x00007FF839590000-0x00007FF8395DF000-memory.dmp
memory/3776-64-0x00007FF8394A0000-0x00007FF8394B2000-memory.dmp
memory/3776-63-0x00007FF8394C0000-0x00007FF8394DB000-memory.dmp
memory/3776-62-0x00007FF8394E0000-0x00007FF83958B000-memory.dmp
memory/3776-61-0x00007FF840020000-0x00007FF840045000-memory.dmp
memory/3776-65-0x00007FF833030000-0x00007FF833275000-memory.dmp
memory/3776-66-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-67-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-68-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-69-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-70-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-107-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-140-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-173-0x00007FF83A180000-0x00007FF83A436000-memory.dmp
memory/3776-206-0x00007FF83A180000-0x00007FF83A436000-memory.dmp