Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 16:36
General
- Target assets/minecraft/sounds/dig/cloth2.ogg
- Size 4KB
- Sample260420-t384vsay5l
- SHA256 55800a8e76ba04e2e7bc01785d86cf6ef1c3be1687f55576894faf16bd0f14f0
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\sounds\dig\cloth2.ogg1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\sounds\dig\cloth2.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4492-0-0x00007FFEC15DD000-0x00007FFEC15DF000-memory.dmp
memory/4492-1-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-2-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-3-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-4-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-5-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-6-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-7-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-8-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-9-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-10-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-11-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-12-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-13-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-14-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-15-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-16-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-18-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-17-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-19-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-20-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-21-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-22-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-23-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-24-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-25-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-26-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-27-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-28-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-29-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-30-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-31-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-32-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-33-0x00007FF7A68E0000-0x00007FF7A69D8000-memory.dmp
memory/4492-34-0x00007FFECE3C0000-0x00007FFECE3F4000-memory.dmp
memory/4492-36-0x00007FFECE560000-0x00007FFECE571000-memory.dmp
memory/4492-38-0x00007FFECE100000-0x00007FFECE122000-memory.dmp
memory/4492-39-0x00007FFECDE30000-0x00007FFECDE5B000-memory.dmp
memory/4492-37-0x00007FFECE130000-0x00007FFECE149000-memory.dmp
memory/4492-41-0x00007FFECE0E0000-0x00007FFECE0F4000-memory.dmp
memory/4492-42-0x00007FFECDE10000-0x00007FFECDE21000-memory.dmp
memory/4492-43-0x00007FFECD610000-0x00007FFECD6E2000-memory.dmp
memory/4492-40-0x00007FFEC0DB0000-0x00007FFEC1140000-memory.dmp
memory/4492-44-0x00007FFEC0B10000-0x00007FFEC0DA6000-memory.dmp
memory/4492-45-0x00007FFEC0A20000-0x00007FFEC0B08000-memory.dmp
memory/4492-54-0x00007FFECD5B0000-0x00007FFECD5C1000-memory.dmp
memory/4492-53-0x00007FFECD5D0000-0x00007FFECD5E1000-memory.dmp
memory/4492-52-0x00007FFECD5F0000-0x00007FFECD60A000-memory.dmp
memory/4492-56-0x00007FFEC0680000-0x00007FFEC0718000-memory.dmp
memory/4492-62-0x00007FFEB6EA0000-0x00007FFEB70E5000-memory.dmp
memory/4492-63-0x00007FFEC1330000-0x00007FFEC15E6000-memory.dmp
memory/4492-61-0x00007FFEC0590000-0x00007FFEC05A2000-memory.dmp
memory/4492-60-0x00007FFEC05B0000-0x00007FFEC05CB000-memory.dmp
memory/4492-59-0x00007FFEC05D0000-0x00007FFEC067B000-memory.dmp
memory/4492-58-0x00007FFEC74B0000-0x00007FFEC74D5000-memory.dmp
memory/4492-57-0x00007FFECD560000-0x00007FFECD5AF000-memory.dmp
memory/4492-55-0x00007FFEC0720000-0x00007FFEC092B000-memory.dmp
memory/4492-51-0x00007FFECD9F0000-0x00007FFECDA1D000-memory.dmp
memory/4492-46-0x00007FFEC0930000-0x00007FFEC0A13000-memory.dmp
memory/4492-50-0x00007FFECDA20000-0x00007FFECDA46000-memory.dmp
memory/4492-48-0x00007FFECDA70000-0x00007FFECDA9F000-memory.dmp
memory/4492-47-0x00007FFECDDC0000-0x00007FFECDE01000-memory.dmp
memory/4492-49-0x00007FFECDA50000-0x00007FFECDA68000-memory.dmp