Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 16:36
General
- Target assets/minecraft/sounds/dig/grass2.ogg
- Size 4KB
- Sample260420-t384vsay5l
- SHA256 55800a8e76ba04e2e7bc01785d86cf6ef1c3be1687f55576894faf16bd0f14f0
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\sounds\dig\grass2.ogg1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\sounds\dig\grass2.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2908-0-0x00007FFCE1ADD000-0x00007FFCE1ADF000-memory.dmp
memory/2908-1-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-2-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-3-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-4-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-5-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-6-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-7-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-8-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-9-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-11-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-10-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-12-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-13-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-14-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-15-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-16-0x00007FFCE1830000-0x00007FFCE1AE6000-memory.dmp
memory/2908-20-0x0000019776470000-0x000001977647C000-memory.dmp
memory/2908-23-0x00007FFCEECB0000-0x00007FFCEECD2000-memory.dmp
memory/2908-24-0x00007FFCEEC80000-0x00007FFCEECAB000-memory.dmp
memory/2908-22-0x00007FFCF2870000-0x00007FFCF2889000-memory.dmp
memory/2908-21-0x00007FFCF4EF0000-0x00007FFCF4F01000-memory.dmp
memory/2908-18-0x00007FFCEEDC0000-0x00007FFCEEDF4000-memory.dmp
memory/2908-17-0x00007FF601540000-0x00007FF601638000-memory.dmp
memory/2908-27-0x00007FFCEED70000-0x00007FFCEED81000-memory.dmp
memory/2908-25-0x00007FFCE12B0000-0x00007FFCE1640000-memory.dmp
memory/2908-26-0x00007FFCEEFB0000-0x00007FFCEEFC4000-memory.dmp
memory/2908-28-0x00007FFCEE5A0000-0x00007FFCEE672000-memory.dmp
memory/2908-29-0x00007FFCE1010000-0x00007FFCE12A6000-memory.dmp
memory/2908-30-0x00007FFCE8B10000-0x00007FFCE8BF8000-memory.dmp
memory/2908-33-0x00007FFCE1D30000-0x00007FFCE1D5F000-memory.dmp
memory/2908-39-0x00007FFCE0DA0000-0x00007FFCE0DB1000-memory.dmp
memory/2908-38-0x00007FFCE0DC0000-0x00007FFCE0DD1000-memory.dmp
memory/2908-37-0x00007FFCE0EA0000-0x00007FFCE0EBA000-memory.dmp
memory/2908-36-0x00007FFCE0EC0000-0x00007FFCE0EED000-memory.dmp
memory/2908-35-0x00007FFCE0EF0000-0x00007FFCE0F16000-memory.dmp
memory/2908-34-0x00007FFCE1F80000-0x00007FFCE1F98000-memory.dmp
memory/2908-41-0x00007FFCE0AD0000-0x00007FFCE0B68000-memory.dmp
memory/2908-46-0x00007FFCE0960000-0x00007FFCE0972000-memory.dmp
memory/2908-45-0x00007FFCE0980000-0x00007FFCE099B000-memory.dmp
memory/2908-47-0x00007FFCD69A0000-0x00007FFCD6BE5000-memory.dmp
memory/2908-44-0x00007FFCE09A0000-0x00007FFCE0A4B000-memory.dmp
memory/2908-43-0x00007FFCE0A50000-0x00007FFCE0A75000-memory.dmp
memory/2908-42-0x00007FFCE0A80000-0x00007FFCE0ACF000-memory.dmp
memory/2908-40-0x00007FFCE0B90000-0x00007FFCE0D9B000-memory.dmp
memory/2908-32-0x00007FFCEE500000-0x00007FFCEE541000-memory.dmp
memory/2908-31-0x00007FFCE0F20000-0x00007FFCE1003000-memory.dmp