Overview
overview
7Static
static
1Honda NSX_Frix42.zip
windows10-2004-x64
1Honda NSX_Frix42.zip
windows11-ltsc_2024-x64
1art/sound/...up.ogg
windows10-2004-x64
7art/sound/...up.ogg
windows11-ltsc_2024-x64
1art/sound/air.ogg
windows10-2004-x64
7art/sound/air.ogg
windows11-ltsc_2024-x64
1art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...16.wav
windows10-2004-x64
6art/sound/...16.wav
windows11-ltsc_2024-x64
1art/sound/...96.wav
windows10-2004-x64
6art/sound/...96.wav
windows11-ltsc_2024-x64
1art/sound/...06.wav
windows10-2004-x64
6art/sound/...06.wav
windows11-ltsc_2024-x64
1art/sound/...00.wav
windows10-2004-x64
6art/sound/...00.wav
windows11-ltsc_2024-x64
1art/sound/...09.wav
windows10-2004-x64
6art/sound/...09.wav
windows11-ltsc_2024-x64
1art/sound/...02.wav
windows10-2004-x64
6art/sound/...02.wav
windows11-ltsc_2024-x64
1art/sound/...07.wav
windows10-2004-x64
6art/sound/...07.wav
windows11-ltsc_2024-x64
1art/sound/...01.wav
windows10-2004-x64
6art/sound/...01.wav
windows11-ltsc_2024-x64
1art/sound/...08.wav
windows10-2004-x64
6art/sound/...08.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
Honda NSX_Frix42.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Honda NSX_Frix42.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
art/sound/air.backup.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
art/sound/air.backup.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
art/sound/air.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
art/sound/air.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
art/sound/blends/nsxaftermarketexhaust.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
art/sound/blends/nsxaftermarketexhaust.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
art/sound/blends/nsxenginetest.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
art/sound/blends/nsxenginetest.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
art/sound/blends/nsxonloadtest.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
art/sound/blends/nsxonloadtest.sfxBlend2D.json
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
art/sound/blends/nsxstockexhaust.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
art/sound/blends/nsxstockexhaust.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1416.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1416.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1796.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1796.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2206.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2206.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2600.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2600.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3009.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3009.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3402.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3402.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3807.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3807.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4201.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4201.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4608.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4608.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2206.wav
- Size 448KB
- Sample260717-15cxrsbs8z
- SHA256 410d38a813968f6ababa1e8fde783a1b66a0e769c1171cbd72c9a881b4ad9ad2
- MD5 88aeb95d83c16a11f2ef7e055760727a
- SHA1 6a84e1207981da1c0645c81bb886c1a787dafe0c
- SHA512 e4bcdd265c6bd680b1269c338bff6534d43f0bcb2b3d2a916450bf29256138ca343a2a14884bad3e8b56972f35d301ed6dbe5cfbb7bee8072e4d7d2b465ec369
- SSDEEP 12288:xI0DXw76biZaK5ZgPmoOBUvh7L+Hh/jeb2M7X4G6s4Kbg:xIeXw7G7gUvh74lKb2MzUs4Kbg
- TLSH T19FA402564EAC34E832B01F57156B0F6AC69CB326212BFCE6595383D31C08B996CCF9D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{1AE8D154-1D3E-4AB9-91B2-B39F48D7E566} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2884 wmplayer.exe Token: SeCreatePagefilePrivilege 2884 wmplayer.exe Token: SeShutdownPrivilege 4760 unregmp2.exe Token: SeCreatePagefilePrivilege 4760 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2884 wrote to memory of 4556 2884 wmplayer.exe 86 PID 4556 wrote to memory of 4760 4556 unregmp2.exe 87
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\Nsx_Aftermarket_Exhaust\nsx_aftermarketexhaust_off_2206.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:224
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 704KB
- SHA256 79bb267e4f78140766e39649752747e4f2cb6f753b01c99c05248c26560b5ce1
- MD5 268278c3d104572261098c8a6f963587
- SHA1 db7f3f9f71fdf0faed0222a60eb5877440ed2059
- SHA512 b2b3cbdb0532918c2a25723737e822f9a7af352c79417c66fefd0786f1f6fce57bb244c5dc6b6c8677c56c9940cfad4f274555d7b12f695996e82cf75cb26876
- SSDEEP 768:i0aleDxcg7KGVp3zT13VuI61HOdrrA9abhrXfEwPRzitFrzAqUmNKX08oJImdbaR:lZPOYpktMhKSo/oGXr1Yl
- TLSH T157E42F3795A0A088DF3C31B1E1BD6F4C7D32A10B12E012425F74A67F7A633D9991B5EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 9d991e1d6d171d7846e93002816b9f66b3b7828a9035ca13df344fa031fee371
- MD5 c25b18ff7e8f8e3ad3028092c5b9d0fc
- SHA1 50ed33369553bdc9674cd1af8501dd0cfc1764ad
- SHA512 b089eb38cafb669333e960492d9f7a562c06ec39a63c7c9450a4ce99e0c52ff72cca883afaaca5d58b83541133b6fc495b0f5a7d6c6eb02131e7a64b27fabc76
- SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaa:rZP2tFP3vqY8bqEMETaBacg
- TLSH T10D258437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D98D1B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 14efb70d7ac495c649e168a72ac9567d14ea1e4a89c02aba96d079ea4dab07fb
- MD5 c99cf24bc7d3288c07f2a0d1571a7922
- SHA1 70c027981b696d54237d4443fa3a8fd5f7d207e8
- SHA512 db7a872c20d233fedc399eca21c0a81416213a7167e63be731b98314a7aea88c303dffbe640e9f7f116ebfb2713a7cf62a84d8bffd2d42bafa6004dde7774319
- SSDEEP 96:7+S1lt2NXtDUMUstL7XtgUMbstXUMlstgOXtZL2t+LXtKtVAtzt:7+dninCna
- TLSH T1CE63CF1023E45659F3FB2E7269FA56176E3B38916E39E04D0714465E0CA9F28EE30B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 0639b8a582f961f816c77cb2d4cab7f6b683f46b09e9a0b74f6214671eedc811
- MD5 ba7d14646c604e46b7f15faf1eee0817
- SHA1 f3c2cbbca6adfac6d202e12d8bcd93189e840b26
- SHA512 1a89a2d3c3321c41ccc45b2bceff60a2ebe623f395ece4b4a4aa4867f4d6fb69b74b439b582242b024644b9434da7579595ca055b062b7d3cfe0af0f40cb52fd
- TLSH T1DD21495B1B8EE87099E01BE71DEC8E2573B787CA8790D0A5B38DA439480252D5B3D46D
- MD5 SHA1 SHA512 TLSH