Overview
overview
6Static
static
1CARTUNEZ.zip
windows11-21h2-x64
1KEN CARSON...ER.mp3
windows11-21h2-x64
KEN CARSON...IT.mp3
windows11-21h2-x64
6KEN CARSON...RD.mp3
windows11-21h2-x64
6KEN CARSON...TH.mp3
windows11-21h2-x64
6KEN CARSON...AR.mp3
windows11-21h2-x64
6KEN CARSON...AY.mp3
windows11-21h2-x64
6KEN CARSON...LD.mp3
windows11-21h2-x64
6KEN CARSON...NT.mp3
windows11-21h2-x64
6KEN CARSON...CK.mp3
windows11-21h2-x64
6KEN CARSON...NK.mp3
windows11-21h2-x64
6KEN CARSON...EY.mp3
windows11-21h2-x64
6KEN CARSON...RS.mp3
windows11-21h2-x64
6KEN CARSON...DZ.mp3
windows11-21h2-x64
6KEN CARSON...AR.mp3
windows11-21h2-x64
6Analysis
- max time kernel
898s - max time network
430s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/07/2026, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
CARTUNEZ.zip
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
KEN CARSON - CARTUNEZ/01 - QUITTER.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
KEN CARSON - CARTUNEZ/02 - SUPER LIT.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
KEN CARSON - CARTUNEZ/03 - HITTING HARD.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
KEN CARSON - CARTUNEZ/04 - ROCKS IN MY TEETH.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
KEN CARSON - CARTUNEZ/05 - JULIUS CASESAR.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
KEN CARSON - CARTUNEZ/06 - PAIN GO AWAY.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
KEN CARSON - CARTUNEZ/07 - FREEZING KOLD.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
KEN CARSON - CARTUNEZ/08 - BASEMENT.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
KEN CARSON - CARTUNEZ/09 - CUSTOM RICK.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
KEN CARSON - CARTUNEZ/10 - TANK.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
KEN CARSON - CARTUNEZ/11 - DIRTY MONEY.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
KEN CARSON - CARTUNEZ/12 - PLANET MARS.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
KEN CARSON - CARTUNEZ/13 - DIAMONDZ.mp3
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
KEN CARSON - CARTUNEZ/14 - LIAR.mp3
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target KEN CARSON - CARTUNEZ/02 - SUPER LIT.mp3
- Size 4.1MB
- Sample260709-zleftaav7x
- SHA256 1d19a22e5922d18af642efb1a9b5da02135d094e8b6ce0e50da5ad5463a47c6d
- MD5 94ffae01a14941ca082c22c401b7badc
- SHA1 9737ede8286ef2352367eb7ce8fd5f800111b16f
- SHA512 902c164a9cc16f60f4b02f6ecd8767c808c0d8994978b03e0bad72bc8f3a90d51ae11d0998e5f51ae13786d9ac413eb079a9e2b70d8b86e1e21881e7d8d6fe83
- SSDEEP 98304:dnyYPVJy9Zl1twYMFiRr5gL2sYI7cyt/1Dg1DDrpqQlO5:geVg9ZBuQlgl7Qw35
- TLSH T1E41633B74356505FC114033256A65EA8DEF70FAE36283056D9E6BB23B5B36BBB720340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{CF0EF3A0-1F5F-4189-8DC1-B17ED2FBD2AB} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 5248 wmplayer.exe Token: SeCreatePagefilePrivilege 5248 wmplayer.exe Token: SeShutdownPrivilege 1076 unregmp2.exe Token: SeCreatePagefilePrivilege 1076 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5248 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5248 wrote to memory of 3012 5248 wmplayer.exe 80 PID 3012 wrote to memory of 1076 3012 unregmp2.exe 81
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\KEN CARSON - CARTUNEZ\02 - SUPER LIT.mp3"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:3640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 256KB
- SHA256 df206446064aaf14fbdf1af6989644b13b91be25b5001e9cac7bacc4a0de281f
- MD5 91a6f37f1e8ed0e688c7b0398dad7580
- SHA1 515ae938b8879ad142e53e053f6c029e0bba95b9
- SHA512 75630187e140305661a96cf93c6c72cfe9903eb9ce58be87ffe70b556fea01880ce5a855dd3110a9d8d29038e07d021fe1ee0f650315a5d457429245390e525b
- SSDEEP 768:s7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:i9
- TLSH T15F44F037D4A1B094DB2CB471E2AC0F88B973240701E415845FF8A9BDB7277D6861F6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 2636f0089cbc8fdc1cc4f5fcccd8c570080a8dd72a21c89cbe819f4d781787af
- MD5 553094b1933a92f0e4a020b72c341558
- SHA1 a4b7cde6d2fa8de33944ce1e51e7432b76a165ab
- SHA512 45398ad74f82b215bd3a106f3d1656d3ee2f382108e18cc6dee46657d1da35f47bd80a17a423851631742ebc360e970825b63a3ca3a9cb0c51eee7d7dda83b1f
- SSDEEP 1536:8ZP2tFP3vqY8iqEMATaBacgVxN+5wi46E2r:8t6h/NTalSxN+5wi46E2
- TLSH T1F2258437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D98D1B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 2341768806a96e109e461a17b27d6d446219559fc8e4c764b5767d4c76895a64
- MD5 7414f3a266e6854d8780bf1ee0962349
- SHA1 8c8416d35ab0e6e9d41d14f9de8e1f335a6c9d39
- SHA512 2d21dfb942817b59da3a531f796d5a5ddffbf4ef4fa5077ac00bdb5c291c7d55966bb9296729698b05b63226091ca2eb03e8e0e49e887a0ca63b29f5b9805779
- SSDEEP 96:pZ9NltnNXtMUMUstS7XtXUMbstQUMlst9OXtGL2tPLXtNtwAtUt:pZMnqnFnC
- TLSH T19663A09163E8865AF3FB2F716AF955161F3A38A16E36D21C0710424F1D70F28EE34B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 f87e79c0226beb17513bb9b24f58325c5899dd0292126ff2ae6b3296e8d69ba2
- MD5 af590bd2a9f72df622548527cf66dc5f
- SHA1 b4dcfbc397e5a90771f4c6f70c6ff757eb642f54
- SHA512 05a7efe8106713dfa693e1db2ca43ced73c93d08535677f01509eb2da50b41c0ddaebf3230c70063c4f0516cd0336226660b562641a2102c2d1f2b8f4c563853
- TLSH T1F5218BA70A0A9470DDA017B769CCCA35B3BAE3CB4764D016B34AE82E490613DB73D06D
- MD5 SHA1 SHA512 TLSH