Analysis
- max time kernel
148s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 16:36
General
- Target assets/minecraft/sounds/dig/grass4.ogg
- Size 5KB
- Sample260420-t384vsay5l
- SHA256 be92a8140b8aab717e23a7979a646a8daabd598ccdbb08949e0cf78069289361
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\assets\minecraft\sounds\dig\grass4.ogg1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\sounds\dig\grass4.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3920-0-0x00007FFB0A74D000-0x00007FFB0A74F000-memory.dmp
memory/3920-1-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-2-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-3-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-4-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-5-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-6-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-7-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-8-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-9-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-10-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-11-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-12-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-13-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-14-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-15-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-16-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-17-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-18-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-19-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-24-0x00007FFB0A4A0000-0x00007FFB0A756000-memory.dmp
memory/3920-30-0x00007FFB1D6D0000-0x00007FFB1D6E1000-memory.dmp
memory/3920-33-0x00007FFB172F0000-0x00007FFB1731B000-memory.dmp
memory/3920-31-0x00007FFB1B3F0000-0x00007FFB1B409000-memory.dmp
memory/3920-32-0x00007FFB17320000-0x00007FFB17342000-memory.dmp
memory/3920-26-0x00007FF67D8C0000-0x00007FF67D9B8000-memory.dmp
memory/3920-27-0x00007FFB185C0000-0x00007FFB185F4000-memory.dmp
memory/3920-29-0x000001DD0AF40000-0x000001DD0AF4C000-memory.dmp
memory/3920-36-0x00007FFB17DE0000-0x00007FFB17DF1000-memory.dmp
memory/3920-35-0x00007FFB18110000-0x00007FFB18124000-memory.dmp
memory/3920-34-0x00007FFB09F20000-0x00007FFB0A2B0000-memory.dmp
memory/3920-37-0x00007FFB16C40000-0x00007FFB16D12000-memory.dmp
memory/3920-38-0x00007FFB09AC0000-0x00007FFB09D56000-memory.dmp
memory/3920-39-0x00007FFB16630000-0x00007FFB16718000-memory.dmp
memory/3920-42-0x00007FFB17060000-0x00007FFB170A1000-memory.dmp
memory/3920-49-0x00007FFB16BD0000-0x00007FFB16BE1000-memory.dmp
memory/3920-48-0x00007FFB16BF0000-0x00007FFB16C01000-memory.dmp
memory/3920-47-0x00007FFB17040000-0x00007FFB1705A000-memory.dmp
memory/3920-46-0x00007FFB16C10000-0x00007FFB16C3D000-memory.dmp
memory/3920-45-0x00007FFB17260000-0x00007FFB17286000-memory.dmp
memory/3920-44-0x00007FFB17970000-0x00007FFB17988000-memory.dmp
memory/3920-43-0x00007FFB172C0000-0x00007FFB172EF000-memory.dmp
memory/3920-40-0x000001DD0CD50000-0x000001DD0CE1D000-memory.dmp
memory/3920-41-0x00007FFB099D0000-0x00007FFB09AB3000-memory.dmp
memory/3920-53-0x00007FFB16600000-0x00007FFB16625000-memory.dmp
memory/3920-52-0x00007FFB16B80000-0x00007FFB16BCF000-memory.dmp
memory/3920-51-0x00007FFB09720000-0x00007FFB097B8000-memory.dmp
memory/3920-56-0x00007FFB165C0000-0x00007FFB165D2000-memory.dmp
memory/3920-54-0x00007FFB09670000-0x00007FFB0971B000-memory.dmp
memory/3920-50-0x00007FFB097C0000-0x00007FFB099CB000-memory.dmp
memory/3920-55-0x00007FFB165E0000-0x00007FFB165FB000-memory.dmp
memory/3920-57-0x00007FFB02780000-0x00007FFB029C5000-memory.dmp
memory/4724-25-0x00000149FE9D0000-0x00000149FEA9D000-memory.dmp