Overview
overview
7Static
static
7D13.zip
windows10-2004-x64
1D13.zip
windows11-21h2-x64
1D13/Minecraft.jar
windows10-2004-x64
6D13/Minecraft.jar
windows11-21h2-x64
6D13/deathscream.mp3
windows10-2004-x64
6D13/deathscream.mp3
windows11-21h2-x64
6D13/native...32.dll
windows10-2004-x64
5D13/native...32.dll
windows11-21h2-x64
5out.dll
windows10-2004-x64
3out.dll
windows11-21h2-x64
3D13/native...64.dll
windows10-2004-x64
1D13/native...64.dll
windows11-21h2-x64
1D13/native...x8.dll
windows10-2004-x64
3D13/native...x8.dll
windows11-21h2-x64
3D13/native...64.dll
windows10-2004-x64
1D13/native...64.dll
windows11-21h2-x64
1D13/native...aw.dll
windows10-2004-x64
3D13/native...aw.dll
windows11-21h2-x64
3D13/native...64.dll
windows10-2004-x64
1D13/native...64.dll
windows11-21h2-x64
1D13/natives/lwjgl.dll
windows10-2004-x64
5D13/natives/lwjgl.dll
windows11-21h2-x64
5out.dll
windows10-2004-x64
3out.dll
windows11-21h2-x64
3D13/native...64.dll
windows10-2004-x64
1D13/native...64.dll
windows11-21h2-x64
1D13/ᅠ.bat
windows10-2004-x64
6D13/ᅠ.bat
windows11-21h2-x64
6Analysis
- max time kernel
900s - max time network
530s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 04:41
Behavioral task
behavioral1
Sample
D13.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
D13.zip
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
D13/Minecraft.jar
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
D13/Minecraft.jar
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
D13/deathscream.mp3
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
D13/deathscream.mp3
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
D13/natives/OpenAL32.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
D13/natives/OpenAL32.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
out.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
out.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
D13/natives/OpenAL64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
D13/natives/OpenAL64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
D13/natives/jinput-dx8.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
D13/natives/jinput-dx8.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
D13/natives/jinput-dx8_64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
D13/natives/jinput-dx8_64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
D13/natives/jinput-raw.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
D13/natives/jinput-raw.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
D13/natives/jinput-raw_64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
D13/natives/jinput-raw_64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
D13/natives/lwjgl.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
D13/natives/lwjgl.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
out.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
out.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
D13/natives/lwjgl64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
D13/natives/lwjgl64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
D13/ᅠ.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
D13/ᅠ.bat
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target D13/deathscream.mp3
- Size 287KB
- Sample260424-fbgnmsbv3n
- SHA256 082294686b07048109764d581d0f0f23c82d23927aa29dd889b05778879054e5
- MD5 9e421d4169971ee4e027c2f36872ff5c
- SHA1 ec1fb384b42d77912637b3ebe3dc9d6052f27bf1
- SHA512 fe883cc9626d911856fc801a3a0292f3d68a92e2c906cd252cf82b47fa15aafdf83fd2c038fc8d194bd183640f552bb15630d5661126b30aebbb0aab155a3114
- SSDEEP 6144:QzlXu9EqsvYLtI4j+s7hFKzKxdE25/XxI/NZxJO+H7UiiP:IXwbuzBGmZLV7U1
- TLSH T1675413532FB3D06C88A60B695FC6A81071272C5FD8B450E6D97CCABA6D3BC90BE55F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{44E0AEE6-1206-4B31-837A-B95BECC26107} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3232 wmplayer.exe Token: SeCreatePagefilePrivilege 3232 wmplayer.exe Token: SeShutdownPrivilege 3832 unregmp2.exe Token: SeCreatePagefilePrivilege 3832 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3232 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3232 wrote to memory of 3928 3232 wmplayer.exe 80 PID 3928 wrote to memory of 3832 3928 unregmp2.exe 81
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\D13\deathscream.mp3"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:2464
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 512KB
- SHA256 c7f599e2fc245d45d29570d9132b901caeaac2dd9ac56485a6fcd6ba7f7ce6eb
- MD5 0108611a366cb6adaa9dcea35d69aac3
- SHA1 f214f77c71bb151616394fbefe5ec978b163d7bc
- SHA512 667c934b8f7797134c67e726fb242a60228dc4c2367f31606e2c151b503a2c4b24dd6d873f4f7654bc6a003e143e8ed59b288ae01192142e057e81cfcad6c415
- SSDEEP 768:i7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjPV:g9tQeoVYocxYCutFC
- TLSH T1B9B41037A470A098DF3C35B2E2AC5B4CBD72641A12E006421F74B57F7A237D8DA1B5E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 32d798a4fac4f564598d38b61b488699883d6ee2c5aa0c189f6c2d4dcb5c47f1
- MD5 c30b868316adab6decf7603a7c6240a6
- SHA1 30733ebc7c274e41dd1db8dad0c831fb1fdb479a
- SHA512 2ed9bd6450e99d28c2a45d15e4887e72c58e7a10dd1ef349177bac41df9d0d5b34ffe213fe075b9cfab9585157c39ef939d14ae88b9a1fa1f84513fc43a68308
- SSDEEP 768:I0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbab:2ZP2tFP3vqY8vqEMSTaBacg
- TLSH T13C257437D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8957E7A633D99D0B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 85153b013409d4f8d8f2a5a67c3769bfb82608b2b77e67c7734fb39bdf1499ef
- MD5 f1931c69d2ecedcaf05055a19dccc42f
- SHA1 1684156a3177a4739c4efe4beb69152e7e48bc35
- SHA512 20bed911eec898228f82b4ecd998e674c57a1f5bf3fc6d0b3ef43ed73b8c2f4927a901d1d4a1954a73f4bcb8fcfeb5536d2ce35579429a2c4fdfe8c031c7e9bf
- SSDEEP 96:WQdV6+TxGuzxTV5cCW5iQNVltmNXtTUMUstb7XtwUMbstnUMlstQOXtpL2tuLXtJ:WQdV6+FGuzxTV5cC1QNmnCnin6
- TLSH T13663C22123E55699F3FB2E716DF666231F3A78915E39D20C0210425E0EB1F29DE72F62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 cb74ec13caea5017fea41b29c761a78aff39477302895a3361dc65883c14e980
- MD5 69a347168819414d567591218312cc95
- SHA1 2772d9d08fd36dbae1babe956ac33974b296bfef
- SHA512 48b2890c5fcb85e630e836944ad8bfc73f040ff011dcd14367de9b6effb2f511077abca3e8dd426f44f87528e92d3cfdd7854699bac5dbcc23d2a4e27f73db58
- TLSH T180218B970A0A95B0DDA007B769DCCA75737AE7CF53A4D026B34EA81E880613DB33E05D
- MD5 SHA1 SHA512 TLSH