Overview
overview
7Static
static
1Honda NSX_Frix42.zip
windows10-2004-x64
1Honda NSX_Frix42.zip
windows11-ltsc_2024-x64
1art/sound/...up.ogg
windows10-2004-x64
7art/sound/...up.ogg
windows11-ltsc_2024-x64
1art/sound/air.ogg
windows10-2004-x64
7art/sound/air.ogg
windows11-ltsc_2024-x64
1art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...16.wav
windows10-2004-x64
6art/sound/...16.wav
windows11-ltsc_2024-x64
1art/sound/...96.wav
windows10-2004-x64
6art/sound/...96.wav
windows11-ltsc_2024-x64
1art/sound/...06.wav
windows10-2004-x64
6art/sound/...06.wav
windows11-ltsc_2024-x64
1art/sound/...00.wav
windows10-2004-x64
6art/sound/...00.wav
windows11-ltsc_2024-x64
1art/sound/...09.wav
windows10-2004-x64
6art/sound/...09.wav
windows11-ltsc_2024-x64
1art/sound/...02.wav
windows10-2004-x64
6art/sound/...02.wav
windows11-ltsc_2024-x64
1art/sound/...07.wav
windows10-2004-x64
6art/sound/...07.wav
windows11-ltsc_2024-x64
1art/sound/...01.wav
windows10-2004-x64
6art/sound/...01.wav
windows11-ltsc_2024-x64
1art/sound/...08.wav
windows10-2004-x64
6art/sound/...08.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
189s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
Honda NSX_Frix42.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Honda NSX_Frix42.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
art/sound/air.backup.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
art/sound/air.backup.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
art/sound/air.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
art/sound/air.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
art/sound/blends/nsxaftermarketexhaust.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
art/sound/blends/nsxaftermarketexhaust.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
art/sound/blends/nsxenginetest.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
art/sound/blends/nsxenginetest.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
art/sound/blends/nsxonloadtest.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
art/sound/blends/nsxonloadtest.sfxBlend2D.json
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
art/sound/blends/nsxstockexhaust.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
art/sound/blends/nsxstockexhaust.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1416.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1416.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1796.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1796.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2206.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2206.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2600.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2600.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3009.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3009.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3402.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3402.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3807.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3807.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4201.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4201.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4608.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4608.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1796.wav
- Size 449KB
- Sample260717-15cxrsbs8z
- SHA256 9c3161477f670d708d8adbfe9e5eafb7f8c6be33df45f2e8eef4dd388cbb613a
- MD5 73304e75836efcc05cbe4b03cb4dc966
- SHA1 e130dcce34fff8dc21ed0f1f24a8a4cdea1e11c9
- SHA512 292b5ad5d51c7000a87657271cbc94806eeb5ffc23541435a1b5cedc43c3407412a5209b0081b372be43380e6882e12b5aeb638a3dadfd42193c21fae9057cb5
- SSDEEP 12288:yPgaYKdcPNhSKN7wdwFOg5SXs9SPGcNRjOJ0+yq88K:7D8E5SXsAFNRy5/8r
- TLSH T1EAA412856B68A1D834D02E6269070B28892D337F11E57CE7505305E37E9CF2DBA4EEDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{899AF690-0530-471D-AD34-F1EE811A3AB7} wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 5412 wmplayer.exe Token: SeCreatePagefilePrivilege 5412 wmplayer.exe Token: SeShutdownPrivilege 772 unregmp2.exe Token: SeCreatePagefilePrivilege 772 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5412 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5412 wrote to memory of 4776 5412 wmplayer.exe 87 PID 4776 wrote to memory of 772 4776 unregmp2.exe 88
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\Nsx_Aftermarket_Exhaust\nsx_aftermarketexhaust_off_1796.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:772
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
- MD5 987a07b978cfe12e4ce45e513ef86619
- SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
- SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
- SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
- TLSH T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 818dd0e64a174403989e80b1cd12b2f479274a51e94e661d57bb557f1b88f45c
- MD5 fc5ab71b85ad93cf8259d71bb3a41565
- SHA1 8e174e566014c8929652135c2e2c48a8e68f3519
- SHA512 4972fd2d88dc587ed619256aa1b37350e5003cf727da21bc1dd23ef7c35e6796572bd143141cd12d3bfa71e69757e5e52e134f96cea2835210dea8a57ff6a7c7
- SSDEEP 768:x0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba9:XZP2tFP3vqY89qEMzTaBacg
- TLSH T1CB258437D190B0C5CE2C7171E9ED8F09BA33A10B11A052465FF8A57E7A633D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 22e623e9026b6ad1bce67c6baafad6802c0dad0e2b4200b15c08c0e436863544
- MD5 a2e2571334f493df29f882abf4676524
- SHA1 0b01fb5b07315def2bc5e3890ccddb04d30efb36
- SHA512 d0699a89025ea70b1d6d86dfba3920bb7c7f4414a03f3c7613cda166e3a533b0bcc4d659e0ec26297ce37be5371d74c72bee41cfcc0f81e53405c552c5959d8c
- SSDEEP 96:JS5B0oDltcNXtFUMUst97XtWUMbstEyUMlstyOXt/L2tELXtctzAtltW:RnSnxynqm
- TLSH T1C963931956E46A59F3F72E716DF556171F3B38A15E39E24C022842CE4DB1F28EE30B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 56c4eae45a60c0189fa7a6ae0754e6b448b0fa58048d378b72172fa394bdc8dd
- MD5 c9903027dbbd982f1c075f70a0240302
- SHA1 2b9f9c62c7f91f792bffc5840d9c5c111e6a8170
- SHA512 f4b7c9d86fc03ad321b5efb6db20a9b4aa62b2b82f48d71b986868bf06ea55cbc86ec334d013d1eb510de83697e6fbd61cd4a03271029cc9b5ad0fe9a21af23a
- TLSH T1C3216B971B4DE87089E01BE75DEC8E2573B7D7CA8390D0A5B388A0394C0352D5B3D16D
- MD5 SHA1 SHA512 TLSH