Analysis
- user interaction
yes - max time kernel
149s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/06/2026, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
01. УПОРЯДОЧЕННЫЙ ХАОС.mp3
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
01. УПОРЯДОЧЕННЫЙ ХАОС.mp3
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 01. УПОРЯДОЧЕННЫЙ ХАОС.mp3
- Size 17.6MB
- Sample260628-pcdstagy5z
- SHA256 8ce7ede2a925a392b73521ce519787e12c87e406992bde744d8f6f94dad3ac1a
- MD5 5363fb489f299a1ac64c3b71f89e5227
- SHA1 7bf42e0b167af2d1cef9108f46e0c1ab42e0aeb1
- SHA512 a152c2a51562fd3673f8fa705816edce3a7e7773663edc2e76a719d32752771c5be5e8f18da672c0aaaed6eb7dd3e4e3888e510c61f8849386ff4f83d216b5b3
- SSDEEP 393216:W30bSNX4GbS1TtYkmZf/xQkeK0K4MP5yz:W3sSNICOtOZJQs0K4O4
- TLSH T12D07F08BA76150AEF0921F7C399FF972D4516E4C2C21DFC99920AB61807FE513F3A189
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{D9529FE0-D88A-4A14-961F-14BF06134527} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2968 wmplayer.exe Token: SeCreatePagefilePrivilege 2968 wmplayer.exe Token: SeShutdownPrivilege 4012 unregmp2.exe Token: SeCreatePagefilePrivilege 4012 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2968 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2816 2968 wmplayer.exe 78 PID 2816 wrote to memory of 4012 2816 unregmp2.exe 79
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\01. УПОРЯДОЧЕННЫЙ ХАОС.mp3"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:1052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 256KB
- SHA256 ffdb9c3d8773e354d5a048e7b48ab4bf684deef7d72482a1762c437ed23d0c8a
- MD5 1553f4412f0373d5333a9f12e49e863c
- SHA1 c117ef6e8cd55a9bdf974a228bde97aadb440cad
- SHA512 ca76ad53c021753f43c166d147f03b873166c63e494f55e20da0077e96fc8dcb48a4012e94b14ae12cce86dfde5901e53ee233ff72b4d68ae7005d0744103ebe
- SSDEEP 768:Sf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:S69
- TLSH T1B4440137E5A0B084DF2CB571E2AC1F48BA73250B01E416465FF4A57DBB633D6890B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 6e0561bac3d6a46e2a33cd5e435ac7c7c0f988a68d467657ac8decc8e93e8e00
- MD5 911b44eedd205044c3a1daa1e78d180e
- SHA1 27dcdaaa6305ccaf4d1efc95b57e895c1c9e76d6
- SHA512 a850d80a16737a6dc6d836d0e8406d36d122b2590d19fd2446e0dc876835f5dc3fc7ddebf9a9984857abbf55f55214e164fa61574b81cfd5c3caa8f876956682
- SSDEEP 768:s0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaH:CZP2tFP3vqY83qEMxTaBacgU
- TLSH T1FC258437D190B0C5CE2C7171E9ED8F09BA23B10B11A052465FF8A57E7A633D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 cae21bcd03a4c7a0271d41d91cc2121280714216d2900290fcb6caf9fd1e2e20
- MD5 f1d3822fd4b8b37206c5db7a81f22bbe
- SHA1 e4e10cd25bbd122b41282ed412ea5fbe7a832fa3
- SHA512 68029d44d9eb8f6b18cdb7c6fa80cf801526fefd1f64c220126cec2a196b67ea8e68f2a2a1a8b6c42ba2be80f42de94a0281c1f88f11fb97e6bf8fa6db6bc8cf
- SSDEEP 96:dUgltSNXt3UMUstH7Xt0UMbstjUMlst8OXtNL2taLXtetZAtHt:dU7nCn2na
- TLSH T14363E45056E8464FF7FB2E316AFA95562F3A3CA16D35D20D1214424E0C71F58DAB0B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 fae25a6cff028c6e32b473884a164f116a4d5cc3dfcd049de858e5225c67bff9
- MD5 f59ad59922d198a8cc1b0c110127e07b
- SHA1 31f455c479f01c7f794a2f8e934f236348b2a4b6
- SHA512 f6eb924523b825e45de2360aeddb8d69e17b30a945e22798d35cfaeb34bbca4637198d1baa824cd6381dc9c2951ad8e91e29822a95696d3bc23ccc414dee7b03
- TLSH T156216B970A0EA570DEA007B769CCCA35B3BAE7CF4364D126B34A981E480513DB73D16D
- MD5 SHA1 SHA512 TLSH