Analysis
- max time kernel
148s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/09/2026, 03:29
General
- Target mus_girl_next_door.ogg
- Size 172KB
- Sample260910-d15ewsfa73
- SHA256 7f33cb935518cc3951a9db03c92d89f0c08ba98acacb67190f9140f4b7391897
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mus_girl_next_door.ogg1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\mus_girl_next_door.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1608-0-0x00007FFC1551D000-0x00007FFC1551F000-memory.dmp
memory/1608-1-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-2-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-3-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-4-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-5-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-6-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-7-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-8-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-9-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-10-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-15-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-16-0x00007FF6580E0000-0x00007FF6581D8000-memory.dmp
memory/1608-17-0x00007FFC2E1C0000-0x00007FFC2E1F4000-memory.dmp
memory/1608-22-0x00007FFC25570000-0x00007FFC2559B000-memory.dmp
memory/1608-21-0x00007FFC29DE0000-0x00007FFC29E02000-memory.dmp
memory/1608-20-0x00007FFC29FF0000-0x00007FFC2A009000-memory.dmp
memory/1608-26-0x00007FFC24CC0000-0x00007FFC24D92000-memory.dmp
memory/1608-29-0x00007FFC1B410000-0x00007FFC1B4F3000-memory.dmp
memory/1608-37-0x00007FFC248D0000-0x00007FFC248E1000-memory.dmp
memory/1608-41-0x00007FFC24850000-0x00007FFC24875000-memory.dmp
memory/1608-40-0x00007FFC24880000-0x00007FFC248CF000-memory.dmp
memory/1608-39-0x00007FFC24410000-0x00007FFC244A8000-memory.dmp
memory/1608-38-0x00007FFC196C0000-0x00007FFC198CB000-memory.dmp
memory/1608-36-0x00007FFC24C80000-0x00007FFC24C91000-memory.dmp
memory/1608-35-0x00007FFC24CA0000-0x00007FFC24CBA000-memory.dmp
memory/1608-34-0x00007FFC251F0000-0x00007FFC2521D000-memory.dmp
memory/1608-33-0x00007FFC25220000-0x00007FFC25246000-memory.dmp
memory/1608-32-0x00007FFC25250000-0x00007FFC25268000-memory.dmp
memory/1608-31-0x00007FFC25270000-0x00007FFC2529F000-memory.dmp
memory/1608-30-0x00007FFC25500000-0x00007FFC25541000-memory.dmp
memory/1608-28-0x00007FFC244B0000-0x00007FFC24598000-memory.dmp
memory/1608-27-0x00007FFC14A10000-0x00007FFC14CA6000-memory.dmp
memory/1608-25-0x00007FFC25550000-0x00007FFC25561000-memory.dmp
memory/1608-24-0x00007FFC28DD0000-0x00007FFC28DE4000-memory.dmp
memory/1608-23-0x00007FFC14CB0000-0x00007FFC15040000-memory.dmp
memory/1608-19-0x00007FFC2E240000-0x00007FFC2E251000-memory.dmp
memory/1608-42-0x000001D687FA0000-0x000001D68980F000-memory.dmp
memory/1608-44-0x00007FFC0D970000-0x00007FFC0DBB5000-memory.dmp
memory/1608-43-0x000001D689810000-0x000001D689B10000-memory.dmp
memory/1608-45-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-135-0x00007FFC15270000-0x00007FFC15526000-memory.dmp
memory/1608-164-0x00007FFC15270000-0x00007FFC15526000-memory.dmp