Analysis
- user interaction
yes - max time kernel
37s - max time network
38s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 02:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
trollface.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
trollface.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target trollface.exe
- Size 5.1MB
- Sample260417-c84b5agy5v
- SHA256 649cf04b196d64253bcd2fd73d590b866baa01e383c9225facedf69c8a5c28aa
- MD5 0484d25d4abd431915e072f3a9f06a55
- SHA1 87254b95597c81dac952007065640ba344491335
- SHA512 74e503b39473b0c73325109b79601a77c00e92b86214e07ab8a7877baa2b0360ef9b7385995a4de0d03a315a71deeddbb24fd668ee5ae731de89a5a08ecdd4a3
- SSDEEP 98304:ueSfN1N/D3X1fV8kEZqQ31QnK64z70orXhwAFH6e9VA4jp4vaaacP5T7YuCB4tG9:uttjwpY5qQ6A+uTk
- TLSH T1EE46012E3BE810B0DD743670C4B78BEB8F5C15119BA673CB95960E3148B1AC26D7E6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trollface.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "145" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{BC306EFD-D542-40F3-BA12-2A8001AD57B7} wmplayer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2276 trollface.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 4100 wmplayer.exe Token: SeCreatePagefilePrivilege 4100 wmplayer.exe Token: SeShutdownPrivilege 2104 unregmp2.exe Token: SeCreatePagefilePrivilege 2104 unregmp2.exe Token: SeShutdownPrivilege 4100 wmplayer.exe Token: SeCreatePagefilePrivilege 4100 wmplayer.exe Token: SeShutdownPrivilege 6132 shutdown.exe Token: SeRemoteShutdownPrivilege 6132 shutdown.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2276 trollface.exe 4100 wmplayer.exe 2276 trollface.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2276 trollface.exe 2276 trollface.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2276 trollface.exe 1772 LogonUI.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2276 wrote to memory of 4100 2276 trollface.exe 78 PID 4100 wrote to memory of 2104 4100 wmplayer.exe 79 PID 2276 wrote to memory of 6132 2276 trollface.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\trollface.exe"C:\Users\Admin\AppData\Local\Temp\trollface.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files\Windows Media Player\wmplayer.exe"C:\Program Files\Windows Media Player\wmplayer.exe" "C:\Users\Admin\AppData\Local\Temp\mi_video.mp4" /fullscreen2⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown /r /f /t 02⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6132
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:3496
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a32855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 384KB
- SHA256 78c6ce168b5c5dcf30951aafdb973ba3cffdeee05ef414f762283f5f19e3e9ef
- MD5 06a09c02e2d203b3caa0c075e687a0c4
- SHA1 8d59caa9db8f11e93774fb19392e2192b98dcefb
- SHA512 6810c8af4a8db23baab88f3d46af936cb70feaae6637caff20e170c29791d3279d691e0d7e00fea796762f5dc4ca600bf9fdf2c9568367cf2f5cb25c36ed687b
- SSDEEP 768:Af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz9MjxngbCjPsgTV8:A698eoVYo
- TLSH T198840F37E5A0B098DB3C75B1E2AC1F4CBD72250B11E406421FB4B57EB6237D58A0B5EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 01b4f8929cf537ad56e48299d73e2a2e88a0387e081aa856eefa716049bd5d0d
- MD5 70672261fd91a8e51b53b5ac4a846bf1
- SHA1 22329675746adb37ae9b3f0ee085113d5ece4ad8
- SHA512 5895ceb46778bcbc1ff19bd1702b3080d853f9f42b7e3936095a547bb28dd4f9e401db94be5db3b4a8afa083748f766ea5cc910b9f140d138cdea3824b19b28a
- SSDEEP 768:w0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba7:uZP2tFP3vqY8BqEMwTaBacgT
- TLSH T1A3258437D190B0C5CF2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
- MD5 5433eab10c6b5c6d55b7cbd302426a39
- SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
- SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
- SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
- TLSH T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mi_video.mp4
- Size 4.4MB
- SHA256 1b4bf7b0f6bc0004e92501552bd6ffbb83f81b52ed461df0d3901e978778bfd6
- MD5 c9b2a09125f3a90b6933291e408921b2
- SHA1 398b9888d2ba688e8be7e007deb5b200b3704958
- SHA512 9fb1a45e6fe313c059f568e9886da42ed8ca258a63d25f2bfaba992ccdfb0f7f8e201f79e578b777c7747b72fa8fa3613c23ff3addb185bed7d71651e983a89f
- SSDEEP 98304:LN1N/D3X1fV8kEZqQ31QnK64z70orXhwAFH6e9VA4jp4vaaacP5T7YuCB4tGYyEa:ZjwpY5qQ6A+uTM
- TLSH T18F26011E2FE82564DD383775C4B34AEFDF880001CAC763CF545B4A6198A5E8A6DBE5C2
- MD5 SHA1 SHA512 SSDEEP TLSH