Analysis
- user interaction
yes - max time kernel
149s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 09:46
General
- Target confetti - milkshake #jerseyclub [AldelleQneA].mp3
- Size 1.9MB
- Sample260730-lrlv7afc53
- SHA256 25c123bc1870d051568b0336701bd2af270940cfad624e78e4a6149370ad8490
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 10 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 11 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\confetti - milkshake #jerseyclub [AldelleQneA].mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\poqexec.exe"C:\Windows\System32\poqexec.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4300-0-0x00007FFB5A21D000-0x00007FFB5A21F000-memory.dmp
memory/4300-1-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-2-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-3-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-4-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-5-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-6-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-8-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-7-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-9-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-10-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-11-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-12-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-15-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-17-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-16-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-14-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-13-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-20-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-19-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-26-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-27-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp
memory/4300-28-0x00007FF730F50000-0x00007FF731048000-memory.dmp
memory/4300-33-0x00007FFB6AF50000-0x00007FFB6AF72000-memory.dmp
memory/4300-32-0x00007FFB6B140000-0x00007FFB6B159000-memory.dmp
memory/4300-31-0x00007FFB6B570000-0x00007FFB6B581000-memory.dmp
memory/4300-34-0x00007FFB66040000-0x00007FFB6606B000-memory.dmp
memory/4300-29-0x00007FFB6A560000-0x00007FFB6A594000-memory.dmp
memory/4300-35-0x00007FFB52AF0000-0x00007FFB52E80000-memory.dmp
memory/4300-37-0x00007FFB6A500000-0x00007FFB6A511000-memory.dmp
memory/4300-36-0x00007FFB6A930000-0x00007FFB6A944000-memory.dmp
memory/4300-47-0x00007FFB5E6D0000-0x00007FFB5E6EA000-memory.dmp
memory/4300-49-0x00007FFB6CE80000-0x00007FFB6CE91000-memory.dmp
memory/4300-48-0x00007FFB5DDA0000-0x00007FFB5DDB1000-memory.dmp
memory/4300-45-0x00007FFB5E6F0000-0x00007FFB5E716000-memory.dmp
memory/4300-46-0x00007FFB5DDC0000-0x00007FFB5DDED000-memory.dmp
memory/4300-44-0x00007FFB65890000-0x00007FFB658A8000-memory.dmp
memory/4300-42-0x00007FFB5E750000-0x00007FFB5E791000-memory.dmp
memory/4300-39-0x00007FFB52850000-0x00007FFB52AE6000-memory.dmp
memory/4300-38-0x00007FFB659A0000-0x00007FFB65A72000-memory.dmp
memory/4300-43-0x00007FFB5E720000-0x00007FFB5E74F000-memory.dmp
memory/4300-54-0x00007FFB59EC0000-0x00007FFB59F6B000-memory.dmp
memory/4300-57-0x00007FFB4C5E0000-0x00007FFB4C825000-memory.dmp
memory/4300-56-0x000001D1BC360000-0x000001D1BC6F0000-memory.dmp
memory/4300-55-0x00007FFB5D210000-0x00007FFB5D22B000-memory.dmp
memory/4300-41-0x00007FFB5DDF0000-0x00007FFB5DED3000-memory.dmp
memory/4300-53-0x00007FFB5DD70000-0x00007FFB5DD95000-memory.dmp
memory/4300-52-0x00007FFB5BDC0000-0x00007FFB5BE0F000-memory.dmp
memory/4300-40-0x00007FFB658B0000-0x00007FFB65998000-memory.dmp
memory/4300-51-0x00007FFB5A460000-0x00007FFB5A4F8000-memory.dmp
memory/4300-50-0x00007FFB52440000-0x00007FFB5264B000-memory.dmp
memory/4300-95-0x00007FFB6A560000-0x00007FFB6A594000-memory.dmp
memory/4300-94-0x00007FF730F50000-0x00007FF731048000-memory.dmp
memory/4300-97-0x00007FFB59F70000-0x00007FFB5A226000-memory.dmp