Analysis
- user interaction
yes - max time kernel
76s - max time network
70s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 18:01
General
- Target Suzu Ichinose s Hot Japanese Creampie young woman Scene.mp4 .exe
- Size 93.1MB
- Sample260910-wlwhjswvbw
- SHA256 90deb10ca96e58a36a1c66a8d8aeb5bfea70fd02d31260803c73e1b261022896
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Suzu Ichinose s Hot Japanese Creampie young woman Scene.mp4 .exe"C:\Users\Admin\AppData\Local\Temp\Suzu Ichinose s Hot Japanese Creampie young woman Scene.mp4 .exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "iniciar.vbs"2⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\Suzu Ichinose s Hot Japanese Creampie young woman Scene.mp4"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\Windows-Telemetry-Diag.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\Windows-Telemetry-Diag.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\01195124\Windows-Telemetry-Diag.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DoSvcs\01195124\Windows-Telemetry-Diag.exe"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Windows-Telemetry-Diag.exe
iniciar.vbs
memory/2668-64-0x000001C55A260000-0x000001C55A41A000-memory.dmp
memory/2668-54-0x00007FFC3DC90000-0x00007FFC3DCAA000-memory.dmp
memory/2668-229-0x00007FFC3D570000-0x00007FFC3D826000-memory.dmp
memory/2668-35-0x00007FF71A040000-0x00007FF71A138000-memory.dmp
memory/2668-36-0x00007FFC3DEF0000-0x00007FFC3DF24000-memory.dmp
memory/2668-38-0x00007FFC47700000-0x00007FFC47711000-memory.dmp
memory/2668-41-0x00007FFC3DD00000-0x00007FFC3DD2B000-memory.dmp
memory/2668-40-0x00007FFC3DEC0000-0x00007FFC3DEE2000-memory.dmp
memory/2668-39-0x00007FFC46670000-0x00007FFC46689000-memory.dmp
memory/2668-37-0x00007FFC3D570000-0x00007FFC3D826000-memory.dmp
memory/2668-44-0x00007FFC42E80000-0x00007FFC42E91000-memory.dmp
memory/2668-42-0x00007FFC310A0000-0x00007FFC31430000-memory.dmp
memory/2668-43-0x00007FFC44550000-0x00007FFC44564000-memory.dmp
memory/2668-45-0x00007FFC3DA00000-0x00007FFC3DAD2000-memory.dmp
memory/2668-46-0x00007FFC30E00000-0x00007FFC31096000-memory.dmp
memory/2668-56-0x00007FFC3D860000-0x00007FFC3D871000-memory.dmp
memory/2668-66-0x000001C55A820000-0x000001C55AA3A000-memory.dmp
memory/2668-63-0x00007FFC374A0000-0x00007FFC374B2000-memory.dmp
memory/2668-197-0x00007FFC3D570000-0x00007FFC3D826000-memory.dmp
memory/2668-133-0x00007FFC3D570000-0x00007FFC3D826000-memory.dmp
memory/2668-60-0x00007FFC3D830000-0x00007FFC3D855000-memory.dmp
memory/2668-62-0x00007FFC3D1B0000-0x00007FFC3D1CB000-memory.dmp
memory/2668-61-0x00007FFC30AF0000-0x00007FFC30B9B000-memory.dmp
memory/2668-65-0x00007FFC2A960000-0x00007FFC2ABA5000-memory.dmp
memory/2668-59-0x00007FFC30BA0000-0x00007FFC30BEF000-memory.dmp
memory/2668-58-0x00007FFC3D3E0000-0x00007FFC3D478000-memory.dmp
memory/2668-55-0x00007FFC3DBE0000-0x00007FFC3DBF1000-memory.dmp
memory/2668-47-0x00007FFC3D910000-0x00007FFC3D9F8000-memory.dmp
memory/2668-53-0x00007FFC3D880000-0x00007FFC3D8AD000-memory.dmp
memory/2668-52-0x00007FFC3D8B0000-0x00007FFC3D8D6000-memory.dmp
memory/2668-51-0x00007FFC3E060000-0x00007FFC3E078000-memory.dmp
memory/2668-50-0x00007FFC3D8E0000-0x00007FFC3D90F000-memory.dmp
memory/2668-49-0x00007FFC3DCB0000-0x00007FFC3DCF1000-memory.dmp
memory/2668-48-0x00007FFC3D480000-0x00007FFC3D563000-memory.dmp
memory/2668-57-0x00007FFC30BF0000-0x00007FFC30DFB000-memory.dmp
memory/2668-101-0x00007FFC3D570000-0x00007FFC3D826000-memory.dmp
memory/2676-26-0x0000000140000000-0x00000001401B6000-memory.dmp
memory/3548-10-0x0000000140000000-0x00000001401B6000-memory.dmp
memory/3548-27-0x0000000140000000-0x00000001401B6000-memory.dmp