Overview
overview
10Static
static
1498780a6-a...39.zip
windows10-2004-x64
1498780a6-a...39.zip
windows11-ltsc_2024-x64
1PACK8/t...p4.lnk
windows10-2004-x64
10PACK8/t...p4.lnk
windows11-ltsc_2024-x64
10PACK8/t...p4.lnk
windows10-2004-x64
10PACK8/t...p4.lnk
windows11-ltsc_2024-x64
10PACK8/t...p4.lnk
windows10-2004-x64
10PACK8/t...p4.lnk
windows11-ltsc_2024-x64
8PACK8/t...p4.lnk
windows10-2004-x64
7PACK8/t...p4.lnk
windows11-ltsc_2024-x64
6PACK8/t...p4.lnk
windows10-2004-x64
8PACK8/t...p4.lnk
windows11-ltsc_2024-x64
8ㅤㅤ/desktop.ini
windows10-2004-x64
1ㅤㅤ/desktop.ini
windows11-ltsc_2024-x64
1ㅤㅤ/tee...be.mp4
windows10-2004-x64
6ㅤㅤ/tee...be.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...ss.mp4
windows10-2004-x64
6ㅤㅤ/tee...ss.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...yf.mp4
windows10-2004-x64
6ㅤㅤ/tee...yf.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...es.mp4
windows10-2004-x64
6ㅤㅤ/tee...es.mp4
windows11-ltsc_2024-x64
1ㅤㅤ/tee...ad.mp4
windows10-2004-x64
6ㅤㅤ/tee...ad.mp4
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/06/2026, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
498780a6-a6d6-49e0-a835-5ac234282139.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
498780a6-a6d6-49e0-a835-5ac234282139.zip
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
PACK8/teenSnapchatdihhfrombe.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
PACK8/teenSnapchatdihhfrombe.mp4.lnk
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
PACK8/teenpussyfeetandass.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
PACK8/teenpussyfeetandass.mp4.lnk
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
PACK8/teenreversecowgirlboyf.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
PACK8/teenreversecowgirlboyf.mp4.lnk
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
PACK8/teenslutdroppanties.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
PACK8/teenslutdroppanties.mp4.lnk
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
PACK8/teenslutpussyspread.mp4.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
PACK8/teenslutpussyspread.mp4.lnk
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
ㅤㅤ/desktop.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
ㅤㅤ/desktop.ini
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
ㅤㅤ/teenSnapchatdihhfrombe.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ㅤㅤ/teenSnapchatdihhfrombe.mp4
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
ㅤㅤ/teenpussyfeetandass.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
ㅤㅤ/teenpussyfeetandass.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
ㅤㅤ/teenreversecowgirlboyf.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ㅤㅤ/teenreversecowgirlboyf.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
ㅤㅤ/teenslutdroppanties.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
ㅤㅤ/teenslutdroppanties.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
ㅤㅤ/teenslutpussyspread.mp4
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
ㅤㅤ/teenslutpussyspread.mp4
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
General
- Target ㅤㅤ/teenpussyfeetandass.mp4
- Size 8.1MB
- Sample260626-e3f1rahw6l
- SHA256 94a1ba68e1a9e3c9419488fc92275c2d332190e0b933f1068f8756b8e5290aae
- MD5 c01e78481573ab0c058964509d141394
- SHA1 134b2d6af7262963651793b0191b8d5c73a84317
- SHA512 85275ca6f797761903bec129218de5ca735348acf31d2a96edab3384d718fddac775014a45424e1604578f138301b75f341e6677526ff00530fb18a81b11fdde
- SSDEEP 196608:1+q/JukFVlQt0lfdmjd5gfjECUVJArkrz/1rKgS4ORGU:5RH/llVmZ5ecrztr5EGU
- TLSH T19C863314BB9B494BD42D33B5B5D47B027949C9206A0B83F3D4BED0F51DEBA486988CEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{BC6561BD-2A56-4A73-9EB1-EA0FE376C9E7} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 4128 wmplayer.exe Token: SeCreatePagefilePrivilege 4128 wmplayer.exe Token: SeShutdownPrivilege 1020 unregmp2.exe Token: SeCreatePagefilePrivilege 1020 unregmp2.exe Token: SeShutdownPrivilege 4128 wmplayer.exe Token: SeCreatePagefilePrivilege 4128 wmplayer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4128 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4128 wrote to memory of 2148 4128 wmplayer.exe 87 PID 2148 wrote to memory of 1020 2148 unregmp2.exe 88
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:1256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 37a7423e34d31060ad96e5b7ba14951a93065e2ca3dc7bd9a29774c9af73e0a9
- MD5 5d3f0b642b0bed33d34c7b635dd5c2da
- SHA1 7433c1da0923704a7c8681ca7ad3553bf5ca6fe8
- SHA512 f4e828dfe095467ef1184f2c365ce909265fe7e54ca4135e204901599f3ab832964b1a5a701c710cb61d0ea3a7f6f23487b3cbbd695c05ab3cc67c8fcdb339d0
- SSDEEP 3:26X/3allkltlsl7pl+e/lls4XplsMlX/l/WI1Xlldl0lcNklltlwzl4hR/mll:2am+1E3+e9XplskX/l+I10cAe
- TLSH T11D539204E3A09572C8048377A4EA8B43B371F0690A2EEB1B602968381D022D92CA0190
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 8a380df3ca75f70d9b878593d9057490148b9abc430f759bf22e138709dcd52b
- MD5 8456915eed5a15d5aefc8b669eaef7e2
- SHA1 025d0788ef553c7187c7231499c05585fb45187d
- SHA512 054e2b4d699e1294cc9e965f37cfdc32f10a2460b4a1d590d36d45208aeac71efc1159664d2fb3636e80b56af701fb4eade7dd3ca0de7b4f25431d1596f8511b
- SSDEEP 768:40aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbav:mZP2tFP3vqY8+qEMbTaBacg
- TLSH T142257437D190B0C5CF2C7171E9ED8F09BA23A10B11A052465FF8957E7A633D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 95b0950ffcdf3916da5958c44f7eed03ca8a6de3d81c2931c7f8ebfbcdbdb2d4
- MD5 7f53c85f4813c5b409b19866d7925dd3
- SHA1 5c9036a741d20893affb5e5d43de09527eb445ef
- SHA512 202795c6779ed35020eea3ed5100c22967c94eadcb84d79c04396eaf7099b8ab48afb56507edbb0a7cc292f95cacd8196624fb4b587a8895d8999b41b9b80978
- SSDEEP 96:k6LmqtaTlt5NXtSUMUsto7XtJUMbst+UMlstTOXt4L2thLXtjtqAt6tJ:kWY4nKnbnS
- TLSH T1B263D15062E94659F3F72E716EF675122E3B38E15E36E04E0324925E09B0F29DE31B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 43c073bfc10624b106afcbc9ea80757812496523723c566708ee62b21ca7911c
- MD5 568528fc546bb04914d0bdfa482007ef
- SHA1 06472aaa7cb851c8a964ffdd3510c88ab9646eb4
- SHA512 dfb571a2e22a77ce9093e715bdc7cf30b0252bd6293cfda9caddda5ca0e432979aaf4efadf157fd055aa05b332d126196a09c8305e8c43d379d3d5b5acf047e8
- TLSH T1CA216E571B8EE87089E01BE71DEC8E257377C7CE43A1E0A5B34CA029480352D5B3E05D
- MD5 SHA1 SHA512 TLSH