Overview
overview
6Static
static
1Ryanherric...IN.rar
windows10-2004-x64
1Ryanherric...IN.rar
windows11-ltsc_2024-x64
1Ryanherric...re.url
windows10-2004-x64
1Ryanherric...re.url
windows11-ltsc_2024-x64
1Ryanherric...re.txt
windows10-2004-x64
1Ryanherric...re.txt
windows11-ltsc_2024-x64
1Ryanherric...on.jpg
windows10-2004-x64
1Ryanherric...on.jpg
windows11-ltsc_2024-x64
1Ryanherric...BG.mov
windows10-2004-x64
6Ryanherric...BG.mov
windows11-ltsc_2024-x64
1Ryanherric...BG.mov
windows10-2004-x64
6Ryanherric...BG.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...SE.mov
windows10-2004-x64
6Ryanherric...SE.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...BG.mov
windows10-2004-x64
6Ryanherric...BG.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...) .mov
windows10-2004-x64
6Ryanherric...) .mov
windows11-ltsc_2024-x64
1Ryanherric...OG.mov
windows10-2004-x64
6Ryanherric...OG.mov
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/07/2026, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
Ryanherrick_ULTIMATE STARTER PACK_AIMERSHIN.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Ryanherrick_ULTIMATE STARTER PACK_AIMERSHIN.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More Resources Here.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More Resources Here.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More free stuff here.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More free stuff here.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/Pls show some appreciation.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/Pls show some appreciation.jpg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- CRT LIGHT LEAK BG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- CRT LIGHT LEAK BG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK BG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK BG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- NOISE.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- NOISE.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT 2 Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT 2 Overlay.mov
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT BG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT BG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM 2 Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM 2 Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT NOISE Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT NOISE Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT BG (BLUE) .mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT BG (BLUE) .mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT OG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT OG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK BG.mov
- Size 15.4MB
- Sample260724-c2sbaaeb99
- SHA256 54326465eec3db72d84f8ab44d7fc4fa33508fe34e2b01b43ecb941e97bbcf76
- MD5 dca7c7f7f1e6cf7c581454c331c9321e
- SHA1 b535bb7184b0bd4ed34a820b9afbb4790527121c
- SHA512 f2616e41bfb66a12ef3ea18b6bf5da295e7dedec7206af3d1e2074563f2e9ec3f2bb4eddf1682089a3bdbf068f61ec99e56786f3ff1bf0196f73171269eae5a1
- SSDEEP 393216:fuD225ybYtxsEFObwMbCXEnYOs2m0Sp6GthTO2M7xruyQq:fuD225yk0eObwMEoRG7uxrYq
- TLSH T135F6332E9381191CCC76DD3DFBBBACA3E79A1045B954E9C939FAC4D0C095322A76831D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E990F3A4-FD33-4C31-A0FB-BF695F201D42} wmplayer.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 4568 wmplayer.exe Token: SeCreatePagefilePrivilege 4568 wmplayer.exe Token: SeShutdownPrivilege 4504 unregmp2.exe Token: SeCreatePagefilePrivilege 4504 unregmp2.exe Token: SeShutdownPrivilege 4568 wmplayer.exe Token: SeCreatePagefilePrivilege 4568 wmplayer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4568 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4568 wrote to memory of 456 4568 wmplayer.exe 83 PID 456 wrote to memory of 4504 456 unregmp2.exe 84
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Ryanherrick - ULTIMATE STARTER PACK\ESSENTIAL OL\RH- LIGHT LEAK BG.mov"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:4388
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 896KB
- SHA256 302f4481ea22d635737600320bacd15e516c3e39ffc49481ac8f36ebcdfefb70
- MD5 26f94060f0adacdbbed82bf75af61497
- SHA1 d4d9d84a33f2123474d1dcc1e996e22342eab755
- SHA512 00d001f5088e19aaf2665da34959d77bd3457a2c4888d0b293b51f4efb289376030b59720b6cb59c63c2cc33a5717ccd4690faec97b333037c6da00354e11dda
- SSDEEP 768:Rf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX08oJImx:RNpZPItFPuNnY4UmqEMioTaBacg
- TLSH T17D153037D150A085CF2C75B1E5ED5F0CBE23A10B12E052465FB4A67BBA633C98D1B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 896KB
- SHA256 20f4e0fa2fc112b7d50433f9ab594cad3d784a953058f534bbe6cf75396b7c03
- MD5 ed7586a5f3067d3e23154b634f6e3eb8
- SHA1 41b6db2b1ea8a0e6d570b988467323f1fe867bc3
- SHA512 3bcf7b81cc4f1c0c8eff9f627fc330c4a26ac935a89d00ec091a0f15d9c84d409307a21c540cbb19f9d3959d06f57efe7364f45f330efb476af304dcdefd80f9
- SSDEEP 768:3f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhrXfEwPRzitFrzAqUmNKX08oJImdb:34ZP6YlHtMfe2NnY4UmqEMioTaBacg
- TLSH T131154237D150A089CF2C31B1E5ED5F0CBE23A10B12E142465FB4A67FBA633C9991B5E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 ec594f8372cae7db19897bf4d5f54372da497d06b16ebbb90496641fec487f6b
- MD5 6421a820c64a7936c89a285208658b0f
- SHA1 ece7a4c7228d6165c6500177f90b685fc17e58ce
- SHA512 52ddd6e311b0c80b7bac775aa0ecfa67288326bce8efb8798af597ec414c2afd12c0ef588ecf5d3232834c391230cb384ecb82c690e014caddbd96c3d15b6dd2
- SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaD:rZP2tFP3vqY8IqEMLTaBacg
- TLSH T166258337D190B0C5CE2C7071E9ED8F09BA63A10B11A052465FF8A57E7A633D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 e8870426d01ecf4e700c8033176283ce195dbe080f80869e94ebbc40a4db20ca
- MD5 2be39782af5622add4fe1f5ccde411bf
- SHA1 03b9223f67435cec39590e9c11cbbe3ff39d2b29
- SHA512 c5fb4c2f18b6f26760a0f2340d993875d2d2920e1dd272d98e308b16ceae48a12b3b48b8f2309e452431914a31640e3fcc848ecb9a1ebea59a7fae0d9e331ac0
- SSDEEP 96:3M5edUlt9NXteUMUst87XtVUMbstyUMlstnOXt0L2tFLXtvt2AtWt:pnKnnni
- TLSH T18463CD1417E8666DF3FB2F7069F995172E3B38915E39D00D0210629EAC62F29D931B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 a4b75e5a549c6563dd370c2c57d65b87bc7642f0d8ff134765ac8c33a69586a4
- MD5 328b2f9ee5cd6506f317e4e493f10ae6
- SHA1 aed5c831b5b73da87b76b5916c4d11b19aed3970
- SHA512 79a52a3b8e60f235a57367de1a2a8b87fd5fe5e315d0beb422d2652f40cb260111e2388fedb86045839d67ff35da1aab1fb17dace08add7b60fc5f3184dcf3bb
- TLSH T14521499A1B4DD87089E01BE75DECCE2573B797CE9390D0A5B34DA03A480252DAB3D06D
- MD5 SHA1 SHA512 TLSH