Analysis
- max time kernel
148s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/09/2026, 03:29
General
- Target mus_noelle_house.ogg
- Size 309KB
- Sample260910-d15ewsfa73
- SHA256 64c760b76bf3379cc248657e608b4bad89118ffc790423c327d6f08fc66553af
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mus_noelle_house.ogg1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\mus_noelle_house.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1748-0-0x00007FF9B4DED000-0x00007FF9B4DEF000-memory.dmp
memory/1748-1-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-2-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-3-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-4-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-5-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-6-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-7-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-8-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-9-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-10-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-11-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-12-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-13-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-14-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-15-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-16-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-17-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-18-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-23-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-24-0x00007FF6FDE40000-0x00007FF6FDF38000-memory.dmp
memory/1748-28-0x00007FF9B4B20000-0x00007FF9B4B39000-memory.dmp
memory/1748-30-0x00007FF9B4AC0000-0x00007FF9B4AEB000-memory.dmp
memory/1748-29-0x00007FF9B4AF0000-0x00007FF9B4B12000-memory.dmp
memory/1748-31-0x00007FF9A4BD0000-0x00007FF9A4F60000-memory.dmp
memory/1748-36-0x00007FF9A4840000-0x00007FF9A4928000-memory.dmp
memory/1748-43-0x00007FF9B3F50000-0x00007FF9B3F6A000-memory.dmp
memory/1748-53-0x000002A8C5D60000-0x000002A8C5D72000-memory.dmp
memory/1748-37-0x00007FF9A4750000-0x00007FF9A4833000-memory.dmp
memory/1748-54-0x000002A8C5D80000-0x000002A8C5DCE000-memory.dmp
memory/1748-52-0x000002A8C5D30000-0x000002A8C5D54000-memory.dmp
memory/1748-51-0x000002A8C5D10000-0x000002A8C5D26000-memory.dmp
memory/1748-50-0x000002A8C5CF0000-0x000002A8C5D09000-memory.dmp
memory/1748-49-0x00007FF9A4400000-0x00007FF9A4425000-memory.dmp
memory/1748-48-0x00007FF9A4430000-0x00007FF9A447F000-memory.dmp
memory/1748-47-0x00007FF9A4480000-0x00007FF9A4518000-memory.dmp
memory/1748-46-0x00007FF9A4520000-0x00007FF9A472B000-memory.dmp
memory/1748-45-0x00007FF9A4730000-0x00007FF9A4741000-memory.dmp
memory/1748-44-0x00007FF9A95E0000-0x00007FF9A95F1000-memory.dmp
memory/1748-42-0x00007FF9A5260000-0x00007FF9A528D000-memory.dmp
memory/1748-40-0x00007FF9B4870000-0x00007FF9B4888000-memory.dmp
memory/1748-39-0x00007FF9B4A50000-0x00007FF9B4A7F000-memory.dmp
memory/1748-55-0x00007FF99E2E0000-0x00007FF99E525000-memory.dmp
memory/1748-41-0x00007FF9A66A0000-0x00007FF9A66C6000-memory.dmp
memory/1748-38-0x00007FF9B4890000-0x00007FF9B48D1000-memory.dmp
memory/1748-35-0x00007FF9A4930000-0x00007FF9A4BC6000-memory.dmp
memory/1748-34-0x00007FF9A9710000-0x00007FF9A97E2000-memory.dmp
memory/1748-33-0x00007FF9B4A80000-0x00007FF9B4A91000-memory.dmp
memory/1748-32-0x00007FF9B4AA0000-0x00007FF9B4AB4000-memory.dmp
memory/1748-27-0x00007FF9B5480000-0x00007FF9B5491000-memory.dmp
memory/1748-25-0x00007FF9B8F30000-0x00007FF9B8F64000-memory.dmp
memory/1748-186-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-218-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp
memory/1748-282-0x00007FF9B4B40000-0x00007FF9B4DF6000-memory.dmp