Overview
overview
7Static
static
1Honda NSX_Frix42.zip
windows10-2004-x64
1Honda NSX_Frix42.zip
windows11-ltsc_2024-x64
1art/sound/...up.ogg
windows10-2004-x64
7art/sound/...up.ogg
windows11-ltsc_2024-x64
1art/sound/air.ogg
windows10-2004-x64
7art/sound/air.ogg
windows11-ltsc_2024-x64
1art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...16.wav
windows10-2004-x64
6art/sound/...16.wav
windows11-ltsc_2024-x64
1art/sound/...96.wav
windows10-2004-x64
6art/sound/...96.wav
windows11-ltsc_2024-x64
1art/sound/...06.wav
windows10-2004-x64
6art/sound/...06.wav
windows11-ltsc_2024-x64
1art/sound/...00.wav
windows10-2004-x64
6art/sound/...00.wav
windows11-ltsc_2024-x64
1art/sound/...09.wav
windows10-2004-x64
6art/sound/...09.wav
windows11-ltsc_2024-x64
1art/sound/...02.wav
windows10-2004-x64
6art/sound/...02.wav
windows11-ltsc_2024-x64
1art/sound/...07.wav
windows10-2004-x64
6art/sound/...07.wav
windows11-ltsc_2024-x64
1art/sound/...01.wav
windows10-2004-x64
6art/sound/...01.wav
windows11-ltsc_2024-x64
1art/sound/...08.wav
windows10-2004-x64
6art/sound/...08.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
Honda NSX_Frix42.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Honda NSX_Frix42.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
art/sound/air.backup.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
art/sound/air.backup.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
art/sound/air.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
art/sound/air.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
art/sound/blends/nsxaftermarketexhaust.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
art/sound/blends/nsxaftermarketexhaust.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
art/sound/blends/nsxenginetest.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
art/sound/blends/nsxenginetest.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
art/sound/blends/nsxonloadtest.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
art/sound/blends/nsxonloadtest.sfxBlend2D.json
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
art/sound/blends/nsxstockexhaust.sfxBlend2D.json
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
art/sound/blends/nsxstockexhaust.sfxBlend2D.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1416.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1416.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1796.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_1796.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2206.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2206.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2600.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_2600.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3009.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3009.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3402.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3402.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3807.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3807.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4201.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4201.wav
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4608.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_4608.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target art/sound/engine/Nsx_Aftermarket_Exhaust/nsx_aftermarketexhaust_off_3807.wav
- Size 450KB
- Sample260717-15cxrsbs8z
- SHA256 5edec098cda4db5b4b4d116f87b3f92f4a1625af33987d1ed544e72c9d69db27
- MD5 86d89fc40da7fcd30d335a5d62996632
- SHA1 d1ffdbed6646bbd0110d02fbc96d28265eb004a3
- SHA512 debd0a4d24f858cfad7e7bf4e2512f4b6de6fe1413a50ad05dea5920c6f86ccecd50723b9dbcd006e36f78b4191a4dd8e02cc9e7bef72bc54062b719adefff2b
- SSDEEP 12288:9EqI4LONWtIZIDKC+Iyx3RV9ZAcCNt2B/0YP6S:9CZEIZIDPXAT9Z0t2l0K6S
- TLSH T177A412456A23F8B120B52D42716E0F4CC818332E347F7EFA69B285C2294996F7DCE65D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{6619E714-B63C-4424-A553-A98B3E54CB64} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4184 wmplayer.exe Token: SeCreatePagefilePrivilege 4184 wmplayer.exe Token: SeShutdownPrivilege 2240 unregmp2.exe Token: SeCreatePagefilePrivilege 2240 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4184 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4184 wrote to memory of 3220 4184 wmplayer.exe 90 PID 3220 wrote to memory of 2240 3220 unregmp2.exe 91
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\Nsx_Aftermarket_Exhaust\nsx_aftermarketexhaust_off_3807.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 be062cf7d058cb58e952b2bdcde58dcb1146350943653efba03b16dc2f91e635
- MD5 78daa6889fe0fc8aa324c0cffb175927
- SHA1 acea507d1b0fbab5b5c9ffeb92f0da5efa47dfc0
- SHA512 65b0d43ab9277d23b6e0591257535aca65fef71fdbbda6cb6754c5fddde1d95be37f63f9355c4573dbaf814619d239ab98de9b4438d4a76347174d0597d92eca
- SSDEEP 3:4nallkltlsl7pl+e/lls4XplsMlE+yHj46O9/lcI1Xlldl0lcNklltlwzl4hR/m/:4u+1E3+e9XplskEvUlcI10cAe
- TLSH T1B9534C04E26057A2C404837764B60747B371B4660A59971B5135643C1C4119929A4185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 7a148d5660229ca1c0c87c518b02397cad83dae8d6d4cae3a5d82752acb18868
- MD5 476fd414ee57c31491442892ba3f05bb
- SHA1 acfb9059fd5506d1350bca1f8b642d29558f6f91
- SHA512 749ef38bf8babea43ae820646a4e0c239e39a1f72d4f86765875aa5c56a9403e2455d301e6f01967a633ddd01a87a113c37dd33fb1335044e0064ea70c11c121
- SSDEEP 768:o0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaK:WZP2tFP3vqY8fqEMHTaBacgB
- TLSH T15F258437D190B0C5CF2C7172E9ED8F09BA23A10B11A052465FF8A57E7A533D98D1B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 f689a43bfbcac4c97ef546deb7da46b51a3c8d68204aa5304e70ab24edad77a1
- MD5 4fea83b7c1f3ff96529ae7644d830de8
- SHA1 35127ff90ffee7faf874e9a7b1f6188478c0801e
- SHA512 b61a4f56eb56c0f1933257e256a2df71d77b741e08bf5558a9bec7d1012bbf15b6e1babaef03c48de0b87f3809f98724f134f22d0f1ec3f6efa4ef2ed4f5f49b
- SSDEEP 96:5jKGGA2ltnNXtMUMUstS7XtXUMbstQUMlst9OXtGL2tPLXtNtwAtUt:xjnqnFnC
- TLSH T15F63042852E94649F3FB2EB17DF9A5162E3A38A15E36D14D0214964E0DE0F1EDDB0B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 ea39321d40f8d9e645645348d6d1fa64c8c43d62e46e6a47257bda7976d0c2de
- MD5 29ce96f2518ca6c17c2181de04867bbb
- SHA1 ed5b3d8e6c0771c3970e4452c4988bc560b564fb
- SHA512 3500134cfc28f390df9a59cc5a74e6467fa7a88410fb66da67e87898d59c3f46aaab11a1f7ba043e4186dd218211a4dfd0a7c1802fffa8285b635b1251683bc5
- TLSH T194218E5B1B8EE87089E01BE75DEC8E2573BBD3CA43A0D0A5738CA039880212D5B3D56D
- MD5 SHA1 SHA512 TLSH