Analysis
- max time kernel
149s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/07/2026, 22:13
General
- Target art/sound/air.ogg
- Size 91KB
- Sample260717-15cxrsbs8z
- SHA256 2270221c7bbdeb00cd16a73af5bc7961f55ef511b1052c950b99db4d2547fb8b
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\art\sound\air.ogg1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\art\sound\air.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2612-0-0x00007FF8D5E2D000-0x00007FF8D5E2F000-memory.dmp
memory/2612-1-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-2-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-3-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-4-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-5-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-6-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-7-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-8-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-9-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-10-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-11-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-12-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-13-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-18-0x00007FF78B0D0000-0x00007FF78B1C8000-memory.dmp
memory/2612-20-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-23-0x00007FF8D6360000-0x00007FF8D6382000-memory.dmp
memory/2612-22-0x00007FF8DAD50000-0x00007FF8DAD69000-memory.dmp
memory/2612-21-0x00007FF8DAFC0000-0x00007FF8DAFD1000-memory.dmp
memory/2612-19-0x00007FF8D9CC0000-0x00007FF8D9CF4000-memory.dmp
memory/2612-24-0x00007FF8D6330000-0x00007FF8D635B000-memory.dmp
memory/2612-27-0x00007FF8D6310000-0x00007FF8D6321000-memory.dmp
memory/2612-26-0x00007FF8D6D20000-0x00007FF8D6D34000-memory.dmp
memory/2612-28-0x00007FF8D5AA0000-0x00007FF8D5B72000-memory.dmp
memory/2612-25-0x00007FF8C9260000-0x00007FF8C95F0000-memory.dmp
memory/2612-29-0x00007FF8C8FC0000-0x00007FF8C9256000-memory.dmp
memory/2612-30-0x00007FF8D57A0000-0x00007FF8D5888000-memory.dmp
memory/2612-37-0x00007FF8D5F10000-0x00007FF8D5F2A000-memory.dmp
memory/2612-39-0x00007FF8D5A80000-0x00007FF8D5A91000-memory.dmp
memory/2612-38-0x00007FF8D5EF0000-0x00007FF8D5F01000-memory.dmp
memory/2612-31-0x00007FF8C8ED0000-0x00007FF8C8FB3000-memory.dmp
memory/2612-36-0x00007FF8D5F30000-0x00007FF8D5F5D000-memory.dmp
memory/2612-35-0x00007FF8D5F60000-0x00007FF8D5F86000-memory.dmp
memory/2612-34-0x00007FF8D6050000-0x00007FF8D6068000-memory.dmp
memory/2612-33-0x00007FF8D6290000-0x00007FF8D62BF000-memory.dmp
memory/2612-32-0x00007FF8D62C0000-0x00007FF8D6301000-memory.dmp
memory/2612-40-0x00007FF8C8CC0000-0x00007FF8C8ECB000-memory.dmp
memory/2612-43-0x00007FF8CEF70000-0x00007FF8CEF95000-memory.dmp
memory/2612-41-0x00007FF8D5700000-0x00007FF8D5798000-memory.dmp
memory/2612-42-0x00007FF8C8C70000-0x00007FF8C8CBF000-memory.dmp
memory/2612-44-0x00007FF8C8BC0000-0x00007FF8C8C6B000-memory.dmp
memory/2612-46-0x00007FF8CF520000-0x00007FF8CF532000-memory.dmp
memory/2612-45-0x00007FF8D56E0000-0x00007FF8D56FB000-memory.dmp
memory/2612-47-0x000001A259560000-0x000001A259625000-memory.dmp
memory/2612-49-0x00007FF8C1850000-0x00007FF8C1A95000-memory.dmp
memory/2612-50-0x00007FF8D5B80000-0x00007FF8D5E36000-memory.dmp
memory/2612-48-0x000001A25B950000-0x000001A25CA00000-memory.dmp
memory/2612-145-0x000001A25B950000-0x000001A25CA00000-memory.dmp
memory/2612-241-0x000001A25B950000-0x000001A25CA00000-memory.dmp
memory/2612-273-0x000001A25B950000-0x000001A25CA00000-memory.dmp
memory/2612-305-0x000001A25B950000-0x000001A25CA00000-memory.dmp
memory/2612-337-0x000001A25B950000-0x000001A25CA00000-memory.dmp
memory/2612-369-0x000001A25B950000-0x000001A25CA00000-memory.dmp