Analysis
- max time kernel
148s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/09/2026, 03:29
General
- Target mus_noelle_happy.ogg
- Size 183KB
- Sample260910-d15ewsfa73
- SHA256 53bba10f477e0d610a2075e462e8d7cb1a83570124b0a9b6a39f0e1eef19bfa4
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mus_noelle_happy.ogg1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\mus_noelle_happy.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1632-0-0x00007FFD35FCD000-0x00007FFD35FCF000-memory.dmp
memory/1632-1-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-2-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-3-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-4-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-5-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-6-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-7-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-8-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-9-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-10-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-11-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-12-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-14-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-13-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-15-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-16-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-17-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-22-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-24-0x00007FFD36800000-0x00007FFD36834000-memory.dmp
memory/1632-23-0x00007FF6BE8B0000-0x00007FF6BE9A8000-memory.dmp
memory/1632-29-0x00007FFD365C0000-0x00007FFD365EB000-memory.dmp
memory/1632-27-0x00007FFD3FC40000-0x00007FFD3FC59000-memory.dmp
memory/1632-26-0x00007FFD407A0000-0x00007FFD407B1000-memory.dmp
memory/1632-28-0x00007FFD365F0000-0x00007FFD36612000-memory.dmp
memory/1632-33-0x00007FFD35C40000-0x00007FFD35D12000-memory.dmp
memory/1632-35-0x00007FFD2B1E0000-0x00007FFD2B2C8000-memory.dmp
memory/1632-47-0x00007FFD262E0000-0x00007FFD2632F000-memory.dmp
memory/1632-41-0x00007FFD2B1B0000-0x00007FFD2B1DD000-memory.dmp
memory/1632-48-0x00007FFD27010000-0x00007FFD27035000-memory.dmp
memory/1632-52-0x0000020F40840000-0x0000020F408D1000-memory.dmp
memory/1632-53-0x00007FFD201C0000-0x00007FFD20405000-memory.dmp
memory/1632-51-0x0000020F407F0000-0x0000020F40832000-memory.dmp
memory/1632-46-0x00007FFD26330000-0x00007FFD263C8000-memory.dmp
memory/1632-45-0x00007FFD263D0000-0x00007FFD265DB000-memory.dmp
memory/1632-44-0x00007FFD2B190000-0x00007FFD2B1A1000-memory.dmp
memory/1632-43-0x00007FFD2C3A0000-0x00007FFD2C3B1000-memory.dmp
memory/1632-42-0x00007FFD35920000-0x00007FFD3593A000-memory.dmp
memory/1632-50-0x0000020F3E920000-0x0000020F3E944000-memory.dmp
memory/1632-49-0x0000020F40740000-0x0000020F407ED000-memory.dmp
memory/1632-40-0x00007FFD35420000-0x00007FFD35446000-memory.dmp
memory/1632-39-0x00007FFD35AD0000-0x00007FFD35AE8000-memory.dmp
memory/1632-38-0x00007FFD36590000-0x00007FFD365BF000-memory.dmp
memory/1632-37-0x00007FFD35BF0000-0x00007FFD35C31000-memory.dmp
memory/1632-36-0x00007FFD265E0000-0x00007FFD266C3000-memory.dmp
memory/1632-34-0x00007FFD266D0000-0x00007FFD26966000-memory.dmp
memory/1632-32-0x00007FFD389C0000-0x00007FFD389D1000-memory.dmp
memory/1632-31-0x00007FFD3A270000-0x00007FFD3A284000-memory.dmp
memory/1632-30-0x00007FFD26970000-0x00007FFD26D00000-memory.dmp
memory/1632-56-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp
memory/1632-180-0x00007FFD35D20000-0x00007FFD35FD6000-memory.dmp