Analysis
- user interaction
yes - max time kernel
111s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
17/08/2026, 08:23
Errors
General
- Target AllMyFellasSplice.wav
- Size 378KB
- Sample260817-kae6mswfjd
- SHA256 50cb01bc4c057d91d19c4985428f47c6a44c6c1e1c79b225d51fc46c49296dae
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 40 IoCs
- Suspicious use of SendNotifyMessage 39 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\AllMyFellasSplice.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ed855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1876-250-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/1876-248-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/1876-259-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/1876-258-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/1876-257-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/1876-255-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/1876-256-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/1876-254-0x0000026A6D560000-0x0000026A6D561000-memory.dmp
memory/5504-31-0x00007FFA316D0000-0x00007FFA31A60000-memory.dmp
memory/5504-39-0x00007FFA44270000-0x00007FFA4429F000-memory.dmp
memory/5504-5-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-7-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-8-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-6-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-9-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-10-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-12-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-11-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-14-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-13-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-15-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-16-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-17-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-22-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-23-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-24-0x00007FF6F9CC0000-0x00007FF6F9DB8000-memory.dmp
memory/5504-25-0x00007FFA48F10000-0x00007FFA48F44000-memory.dmp
memory/5504-29-0x00007FFA49DD0000-0x00007FFA49DF2000-memory.dmp
memory/5504-28-0x00007FFA4A8C0000-0x00007FFA4A8D9000-memory.dmp
memory/5504-27-0x00007FFA4B4C0000-0x00007FFA4B4D1000-memory.dmp
memory/5504-3-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-35-0x00007FFA32470000-0x00007FFA32706000-memory.dmp
memory/5504-36-0x00007FFA33C50000-0x00007FFA33D38000-memory.dmp
memory/5504-4-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-37-0x00007FFA315E0000-0x00007FFA316C3000-memory.dmp
memory/5504-38-0x00007FFA45000000-0x00007FFA45041000-memory.dmp
memory/5504-34-0x00007FFA34470000-0x00007FFA34542000-memory.dmp
memory/5504-30-0x00007FFA48EA0000-0x00007FFA48ECB000-memory.dmp
memory/5504-33-0x00007FFA46220000-0x00007FFA46231000-memory.dmp
memory/5504-32-0x00007FFA492F0000-0x00007FFA49304000-memory.dmp
memory/5504-45-0x00007FFA40640000-0x00007FFA40651000-memory.dmp
memory/5504-54-0x000001DFC5E30000-0x000001DFC5E41000-memory.dmp
memory/5504-55-0x00007FFA2B840000-0x00007FFA2BA85000-memory.dmp
memory/5504-50-0x00007FFA384F0000-0x00007FFA3859B000-memory.dmp
memory/5504-53-0x000001DFC5E10000-0x000001DFC5E21000-memory.dmp
memory/5504-52-0x000001DFC5DF0000-0x000001DFC5E04000-memory.dmp
memory/5504-51-0x00007FFA3CE00000-0x00007FFA3CE1B000-memory.dmp
memory/5504-47-0x00007FFA3CE20000-0x00007FFA3CEB8000-memory.dmp
memory/5504-49-0x00007FFA3E970000-0x00007FFA3E995000-memory.dmp
memory/5504-48-0x00007FFA3C2B0000-0x00007FFA3C2FF000-memory.dmp
memory/5504-46-0x00007FFA313D0000-0x00007FFA315DB000-memory.dmp
memory/5504-2-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-1-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp
memory/5504-0-0x00007FFA3884D000-0x00007FFA3884F000-memory.dmp
memory/5504-44-0x00007FFA43790000-0x00007FFA437A1000-memory.dmp
memory/5504-43-0x00007FFA441F0000-0x00007FFA4420A000-memory.dmp
memory/5504-42-0x00007FFA44210000-0x00007FFA4423D000-memory.dmp
memory/5504-41-0x00007FFA44240000-0x00007FFA44266000-memory.dmp
memory/5504-40-0x00007FFA451C0000-0x00007FFA451D8000-memory.dmp
memory/5504-339-0x00007FFA385A0000-0x00007FFA38856000-memory.dmp