Analysis
- max time kernel
898s - max time network
435s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 04:41
General
- Target D13/deathscream.mp3
- Size 287KB
- Sample260424-fbgnmsbv3n
- SHA256 082294686b07048109764d581d0f0f23c82d23927aa29dd889b05778879054e5
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\D13\deathscream.mp3"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
LocalMLS_3.wmdb
WMSDKNS.DTD
WMSDKNS.XML
wmsetup.log
memory/1444-2-0x0000000001380000-0x00000000013DF000-memory.dmp
memory/4796-75-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-83-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-33-0x0000000004930000-0x0000000004940000-memory.dmp
memory/4796-32-0x0000000004930000-0x0000000004940000-memory.dmp
memory/4796-35-0x0000000004930000-0x0000000004940000-memory.dmp
memory/4796-36-0x0000000004930000-0x0000000004940000-memory.dmp
memory/4796-37-0x0000000002640000-0x000000000269F000-memory.dmp
memory/4796-38-0x00000000043A0000-0x00000000043A8000-memory.dmp
memory/4796-50-0x0000000007AD0000-0x0000000007AE0000-memory.dmp
memory/4796-52-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-53-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-54-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-55-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-57-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-58-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-82-0x0000000007AD0000-0x0000000007AE0000-memory.dmp
memory/4796-59-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-64-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-63-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-62-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-68-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-69-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-73-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-72-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-71-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-70-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-74-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-31-0x0000000004930000-0x0000000004940000-memory.dmp
memory/4796-76-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-77-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-34-0x0000000004930000-0x0000000004940000-memory.dmp
memory/4796-79-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-60-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-81-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-80-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-84-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-85-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-86-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-90-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-93-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-92-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-91-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-89-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-88-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-87-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-94-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-96-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-98-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-100-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-99-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-97-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-101-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-102-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-103-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-104-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-106-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-107-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-108-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-109-0x0000000007AD0000-0x0000000007AE0000-memory.dmp
memory/4796-110-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-112-0x0000000007CE0000-0x0000000007CF0000-memory.dmp
memory/4796-111-0x0000000007C90000-0x0000000007CA0000-memory.dmp
memory/4796-113-0x0000000007CE0000-0x0000000007CF0000-memory.dmp