Analysis
- max time kernel
899s - max time network
423s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 08:47
General
- Target onicity.mp4
- Size 52.5MB
- Sample260531-kpy73afs8p
- SHA256 78b7d1d48efa9d7b5b0e7131d51d955ad0332b44a2978a71c4c3ae8870656ecd
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\onicity.mp4"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
LocalMLS_3.wmdb
WMSDKNS.DTD
WMSDKNS.XML.bak
wmsetup.log
memory/2704-33-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-35-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-34-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-32-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-36-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-37-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-38-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-39-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-41-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-40-0x0000000007530000-0x0000000007540000-memory.dmp
memory/2704-42-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-59-0x0000000007D00000-0x0000000007D10000-memory.dmp
memory/2704-60-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-61-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-62-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-63-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-65-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-64-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-67-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-66-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-70-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-69-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-68-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-71-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-72-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-75-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-76-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-74-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-73-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-77-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-78-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-79-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-82-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-84-0x0000000007D00000-0x0000000007D10000-memory.dmp
memory/2704-83-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-81-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-85-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-80-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-87-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-86-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-88-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-90-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-92-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-95-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-94-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-93-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-91-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-89-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-96-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-101-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-100-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-99-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-98-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-97-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-102-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-104-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-103-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-106-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-108-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-109-0x0000000007D00000-0x0000000007D10000-memory.dmp
memory/2704-107-0x000000000A380000-0x000000000A390000-memory.dmp
memory/2704-110-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-105-0x0000000007D50000-0x0000000007D60000-memory.dmp
memory/2704-111-0x0000000007D50000-0x0000000007D60000-memory.dmp