Analysis
- user interaction
yes - max time kernel
118s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 22:52
General
- Target 2026-07 Anime Collection.torrent
- Size 35KB
- Sample260808-2tc9tsff99
- SHA256 43334002301e075606dedc86eb75b0b5f3d74f9644511cfa2f8895cbb3371a96
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of FindShellTrayWindow 18 IoCs
- Suspicious use of SendNotifyMessage 17 IoCs
- Suspicious use of SetWindowsHookEx 24 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\2026-07 Anime Collection.torrent"1⤵
- Executes a command shell one-liner
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\2026-07 Anime Collection.torrent"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vlc-qt-interface.ini
memory/4620-27-0x00007FFAD1C20000-0x00007FFAD1CB8000-memory.dmp
memory/4620-24-0x00007FFAD2140000-0x00007FFAD2151000-memory.dmp
memory/4620-9-0x00007FFAC3A30000-0x00007FFAC3A52000-memory.dmp
memory/4620-8-0x00007FFAC4E10000-0x00007FFAC4E29000-memory.dmp
memory/4620-14-0x00007FFAC3900000-0x00007FFAC39D2000-memory.dmp
memory/4620-13-0x00007FFAC39E0000-0x00007FFAC39F1000-memory.dmp
memory/4620-16-0x00007FFAC2A30000-0x00007FFAC2B18000-memory.dmp
memory/4620-25-0x00007FFAD1FE0000-0x00007FFAD1FF1000-memory.dmp
memory/4620-26-0x00007FFAC2700000-0x00007FFAC290B000-memory.dmp
memory/4620-33-0x000002405D6C0000-0x000002405D82B000-memory.dmp
memory/4620-34-0x00007FFAB8D60000-0x00007FFAB8FA5000-memory.dmp
memory/4620-32-0x00007FFAD1B30000-0x00007FFAD1B42000-memory.dmp
memory/4620-31-0x00007FFAD1B50000-0x00007FFAD1B6B000-memory.dmp
memory/4620-30-0x00007FFAD1B70000-0x00007FFAD1C1B000-memory.dmp
memory/4620-10-0x00007FFAC3A00000-0x00007FFAC3A2B000-memory.dmp
memory/4620-28-0x00007FFAD1F90000-0x00007FFAD1FDF000-memory.dmp
memory/4620-29-0x00007FFAD1F60000-0x00007FFAD1F85000-memory.dmp
memory/4620-5-0x00007FFAC3D20000-0x00007FFAC3D54000-memory.dmp
memory/4620-23-0x00007FFAD2160000-0x00007FFAD217A000-memory.dmp
memory/4620-22-0x00007FFAC2910000-0x00007FFAC293D000-memory.dmp
memory/4620-21-0x00007FFAC3300000-0x00007FFAC3326000-memory.dmp
memory/4620-20-0x00007FFAC3330000-0x00007FFAC3348000-memory.dmp
memory/4620-19-0x00007FFAC3880000-0x00007FFAC38AF000-memory.dmp
memory/4620-18-0x00007FFAC38B0000-0x00007FFAC38F1000-memory.dmp
memory/4620-17-0x00007FFAC2940000-0x00007FFAC2A23000-memory.dmp
memory/4620-15-0x00007FFAC2B20000-0x00007FFAC2DB6000-memory.dmp
memory/4620-12-0x00007FFAC4D50000-0x00007FFAC4D64000-memory.dmp
memory/4620-11-0x00007FFAC2DC0000-0x00007FFAC3150000-memory.dmp
memory/4620-6-0x00007FFAC3A60000-0x00007FFAC3D16000-memory.dmp
memory/4620-7-0x00007FFAD1730000-0x00007FFAD1741000-memory.dmp
memory/4620-4-0x00007FF7C4E00000-0x00007FF7C4EF8000-memory.dmp
memory/4620-47-0x00007FFAC3A60000-0x00007FFAC3D16000-memory.dmp