Analysis
- max time kernel
149s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/07/2026, 22:13
General
- Target art/sound/air.backup.ogg
- Size 88KB
- Sample260717-15cxrsbs8z
- SHA256 14cb48ce33f5d498d1b18a4122bdefec49eed4825862864b513930fde8238f4d
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\art\sound\air.backup.ogg1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\art\sound\air.backup.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4536-0-0x00007FFD9B1AD000-0x00007FFD9B1AF000-memory.dmp
memory/4536-1-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-2-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-3-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-4-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-5-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-6-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-7-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-8-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-9-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-10-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-11-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-12-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-15-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-14-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-13-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-16-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-17-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-19-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-21-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-20-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-18-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-22-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-27-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-28-0x00007FFD9AF00000-0x00007FFD9B1B6000-memory.dmp
memory/4536-30-0x00007FFDA8C30000-0x00007FFDA8C64000-memory.dmp
memory/4536-35-0x00007FFDA83C0000-0x00007FFDA83EB000-memory.dmp
memory/4536-34-0x00007FFDA83F0000-0x00007FFDA8412000-memory.dmp
memory/4536-33-0x00007FFDA8740000-0x00007FFDA8759000-memory.dmp
memory/4536-38-0x00007FFDA80A0000-0x00007FFDA80B1000-memory.dmp
memory/4536-41-0x00007FFD9A7E0000-0x00007FFD9A8C8000-memory.dmp
memory/4536-50-0x00007FFDA0E20000-0x00007FFDA0E31000-memory.dmp
memory/4536-57-0x00007FFD9A260000-0x00007FFD9A272000-memory.dmp
memory/4536-56-0x00007FFD9A280000-0x00007FFD9A29B000-memory.dmp
memory/4536-55-0x00007FFD9A2A0000-0x00007FFD9A34B000-memory.dmp
memory/4536-54-0x00007FFD9A350000-0x00007FFD9A375000-memory.dmp
memory/4536-53-0x00007FFDA0DD0000-0x00007FFDA0E1F000-memory.dmp
memory/4536-52-0x00007FFD9A440000-0x00007FFD9A4D8000-memory.dmp
memory/4536-51-0x00007FFD9A4E0000-0x00007FFD9A6EB000-memory.dmp
memory/4536-49-0x00007FFDA75B0000-0x00007FFDA75C1000-memory.dmp
memory/4536-48-0x00007FFDA7AA0000-0x00007FFDA7ABA000-memory.dmp
memory/4536-47-0x00007FFDA66F0000-0x00007FFDA671D000-memory.dmp
memory/4536-46-0x00007FFDA7C50000-0x00007FFDA7C76000-memory.dmp
memory/4536-45-0x00007FFDA7F40000-0x00007FFDA7F58000-memory.dmp
memory/4536-44-0x00007FFDA7FF0000-0x00007FFDA801F000-memory.dmp
memory/4536-43-0x00007FFDA7C80000-0x00007FFDA7CC1000-memory.dmp
memory/4536-42-0x00007FFD9A6F0000-0x00007FFD9A7D3000-memory.dmp
memory/4536-40-0x00007FFD9A8D0000-0x00007FFD9AB66000-memory.dmp
memory/4536-39-0x00007FFDA7CD0000-0x00007FFDA7DA2000-memory.dmp
memory/4536-37-0x00007FFDA8720000-0x00007FFDA8734000-memory.dmp
memory/4536-36-0x00007FFD9AB70000-0x00007FFD9AF00000-memory.dmp
memory/4536-32-0x00007FFDA8760000-0x00007FFDA8771000-memory.dmp
memory/4536-29-0x00007FF731C90000-0x00007FF731D88000-memory.dmp
memory/4536-59-0x0000026600000000-0x0000026600011000-memory.dmp
memory/4536-60-0x0000026600020000-0x0000026600036000-memory.dmp
memory/4536-58-0x0000026600150000-0x0000026600450000-memory.dmp
memory/4536-61-0x0000026600450000-0x000002660058B000-memory.dmp
memory/4536-62-0x00007FFD91730000-0x00007FFD91975000-memory.dmp