3939fcaa3b0efd6d601da475abea862d9f7c078643f1063df51c83609cf47a6f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data/flutter_assets/resources/audio/AbominationPissed_EN.wav
Size 80KB
Sample260718-v41dsagy8l
SHA256 3939fcaa3b0efd6d601da475abea862d9f7c078643f1063df51c83609cf47a6f
MD5 04de7b1fd5d0fce157b378ebede59df1
SHA1 97709ff9bef57080569f04f99efec6098cba3bc1
SHA512 31dcee1e7f1da84853bc8e41c108b1856020ea8da09bf2dd75b2902223f96540e148be9daa2e802358a5d78296ca5c90fa68c8f34f0a52b610f9bad446fff728
SSDEEP 1536:S14LKwKeetzn+sXGAxqcMN5fU0gB35ZIlRMjzVG+G894hDL0MZxvpKi:7LK6wznrvMcMNgxoMXVG+39+PVPh
TLSH
T1AA83E193F451D7500833C9225D467C004F9BFE9FADA72A1BB507EE80F163351BA766A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{73B96DFF-3824-43B0-87CC-FEF1AA874FEC}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1436	wmplayer.exe
Token: SeCreatePagefilePrivilege	1436	wmplayer.exe
Token: SeShutdownPrivilege	1432	unregmp2.exe
Token: SeCreatePagefilePrivilege	1432	unregmp2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1436	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4372	1436	wmplayer.exe	84
PID 4372 wrote to memory of 1432	4372	unregmp2.exe	85

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\resources\audio\AbominationPissed_EN.wav"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 512KB
SHA256 0bff85979e3b8299ee9f3f89d964e5b16d7c0ab3945ba6396b07295a33cc026d
MD5 6d37c77b1258c734cee5222fe9f54588
SHA1 1787bf68ba30bff360f599648e3fa703b05ab9cf
SHA512 04c5338a8f686aee2d43557258dccab9b57e0086c0ff834e8ba693b81b6058467e6c35206000de6ed847fc51fd2e3a2ddbc1b52586f006d0eb429fed097006fd
SSDEEP 768:5f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3:569tQeoVYoUxYCutFC
TLSH
T186B41037A560A098DF3C35B1E2AC5F4CBD72650B12E006421F74B57F7A237D98A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 b8303bc29b644e6de7fb7f00feff58ba8f299c33968fb32b7b7ede67c2a10cbf
MD5 8a31cbbfa622c7ef0cd7c4ee4e3606e0
SHA1 24220c8739087f9f9de26d0be98200d13dd6579c
SHA512 d0a5a044349f9aca03c0f2a71f5d3093500d382dd4478003d1b106db851cdefb0782550a669179a5a38d4659d41467b23312806bb5de072ad8e0f4cf239fc2fb
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba4:rZP2tFP3vqY8AqEM/TaBacg
TLSH
T110257337D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 39e5ce68c81fbc81e9f6cc325a16861ef3f7c90032279e58bda73821d0590dda
MD5 747d1cd2f8dedaae8a2605a4cb2fe139
SHA1 25892aa13135ac3ef166092d96dd713591f7c120
SHA512 3eb8af58e790366b1444e993b5c92987a5ec926d596bff39ce2e82de3e28adc744a7b1c632b723a5db6b462b96aea4886c9966d828ea78149878dcea77912f81
SSDEEP 96:C5xX2HeltoRNXtdUMUst17XtuUMbstJUMlstKOXtHL2tMLXt0tbAttt:C5xXknynsna
TLSH
T1C863B75473F45B4DF3FB2E70A9F955171E7AB8A15E39D71C0250428D0CA0F18EA70B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 779cc3f656b4bcddaab8b396aad4e8a9ab37405a787897e2f3f5db7fcdc28144
MD5 506f4abe2f269ff4f8e98455b5420bb9
SHA1 49ce4d5f3ace61fadb3e2427e28828a2434852ee
SHA512 b4e5d04da53363e68aed03a344091cc3833d8f5b013753b6f973b7745c879527a4b1f7eceb7dc0c54fae27ebe4af7af1d47968ceac1997a48fc9458ef3eed0b1
TLSH
T1AC218E571B4DD8708AE01BE71DEC8E257377C7CA8360D0A57389E039480312D5B3D46D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1436-30-0x00000000047B0000-0x00000000047C0000-memory.dmp

Download

memory/1436-31-0x00000000047B0000-0x00000000047C0000-memory.dmp

Download

memory/1436-32-0x00000000047B0000-0x00000000047C0000-memory.dmp

Download

memory/1436-33-0x00000000047B0000-0x00000000047C0000-memory.dmp

Download

memory/1436-35-0x00000000047B0000-0x00000000047C0000-memory.dmp

Download

memory/1436-34-0x00000000047B0000-0x00000000047C0000-memory.dmp

Download

memory/1436-44-0x0000000000370000-0x0000000000380000-memory.dmp

Download

memory/1436-46-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-47-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-48-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-50-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-55-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-56-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-58-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-61-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-60-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-59-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-57-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-62-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-63-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-64-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-66-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-67-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-65-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-68-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-69-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-70-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-71-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-72-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-73-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-74-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-75-0x0000000000370000-0x0000000000380000-memory.dmp

Download

memory/1436-76-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-78-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-77-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-79-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-81-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-83-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-86-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-85-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-84-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-82-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-80-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-87-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-88-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-92-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-91-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-90-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-89-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-93-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-95-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-96-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-94-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-99-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-98-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-100-0x0000000000370000-0x0000000000380000-memory.dmp

Download

memory/1436-97-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-101-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-102-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-103-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-104-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-106-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/1436-107-0x0000000007320000-0x0000000007330000-memory.dmp

Download

memory/1436-105-0x0000000007380000-0x0000000007390000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads