7db94c3b79e825fdb2d0d7b9b072a1cc70aac7c8b9d82b4fc45966a6a344c2d8

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT 2 Overlay.mov
Size 160KB
Sample260724-c2sbaaeb99
SHA256 7db94c3b79e825fdb2d0d7b9b072a1cc70aac7c8b9d82b4fc45966a6a344c2d8
MD5 8c9252fc2ab633111e6b68a2d102f015
SHA1 b7aafe023fa3f07579ec975de5b10422ef67ee0a
SHA512 2f49d019d535aa1e7d0da7ec1452aa23ab42328fef79c58963c0734dd2f889c22ffde03eb75bda0d31f29ddc498bd48776dd06545f3ea68f5a52e5c7d786096f
SSDEEP 1536:EaNznoPcFjX4bYZdJWBYDK3Gka3R9rN7WErPF+TZkWQ:EunoktDFWCKWka3LrBfrPkZk9
TLSH
T12FF302C373F25855E131E6315A331031A96597F9A10E1267664EE1E51F3A3C8FF2372A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{3ED7B316-BC31-4796-BA7C-DA9A5DA3EA8E}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4268	wmplayer.exe
Token: SeCreatePagefilePrivilege	4268	wmplayer.exe
Token: SeShutdownPrivilege	6040	unregmp2.exe
Token: SeCreatePagefilePrivilege	6040	unregmp2.exe
Token: SeShutdownPrivilege	4268	wmplayer.exe
Token: SeCreatePagefilePrivilege	4268	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4268	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 6000	4268	wmplayer.exe	83
PID 6000 wrote to memory of 6040	6000	unregmp2.exe	84

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Ryanherrick - ULTIMATE STARTER PACK\ESSENTIAL OL\RH- VERT 2 Overlay.mov"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:6040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 775126636bbba52f75e79865140befc804a6a93e68b0a8d4451fd5b31e4812c4
MD5 3d0acdd639d2786dcd384aeabf2c1d19
SHA1 19b576266a025fd4e30c6890c4c7915cf990137c
SHA512 f0016cb85afa7c4e407a2123f9f7614d125cf4a1998d6ff7136f9c8d0dfb92c50837748bf67c716519a03fff9925d759cf6edac3d0402e8e708dafd943616d4a
SSDEEP 768:nf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt35:n69tQeoVYo
TLSH
T12E843037E5A0A084DF3C7171E2AC1F4CBE72650B11E406425FB4B57EBA237D58A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 ad78719897b44737ca1c10dce2d7c7922d9a6cc3479f49a184b47f5dba69b5d3
MD5 f4c950cc4b1cf71a5b8b55d6e7140efe
SHA1 d75a640ec69c51f262a7cb649f635d4955828f1a
SHA512 a1de80748cfac340df5b161569d0ac7903df13ee4c80d8d637e5e9c000498570d0e9e56e42a8a1a00db7b3e9f504e6172c7e9beb3570d0fa81e5e7247d5c950f
SSDEEP 768:z/0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbK:zxZP2tFP3vqY89qEM8TaBacg
TLSH
T176258437D190B0C5CF2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 40a34f7bba5940214afcb76d31cdf44b9eda2511e4b9b12fdd365e0b143c7f7b
MD5 aa8148541503f74cfb22706a321432b1
SHA1 d3e532f15341410d8518d1934f15f52c978f53d6
SHA512 8e40f97518359c7107e5d81506205c706d5ceb56691afc8e645dd24d5e65ed927813591babaf6e2fdce511b6b4100298268750212fcd031355e0837ce10eac1e
SSDEEP 96:pYhsltcNXtFUMUst97XtWUMbstEyUMlstyOXt/L2tELXtctzAtltF:pYhnSnxynq
TLSH
T1C663D32026F46659F3FB3F717EFA55162E3A38A49E39E00E0654524D0C62F28DE34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 996f43abf25b879ab73a68e1c1d025d9fdcb42147428be26a5b1f082fd59b762
MD5 c2e72af668d1b84a184885465a65ca3c
SHA1 f71d974cc906ea44f5e534d8f31b5f8b21a462ff
SHA512 c07475f532024cffc6855e1739841aefeb73468629e23f3b414cbd7fa17ab2d125b65005518c423c5127003d1d2a9737e51552f738bb8d4e973b8e8bd5a9b6bb
TLSH
T1CD216B9B2B4DD47089E01BE75DEC8E2573B7D7CA9390D0A5B34DA039480352D9B3D16D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4268-32-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-33-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-35-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-34-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-37-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-36-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-38-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-41-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-42-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-40-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4268-39-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-47-0x000000000BA90000-0x000000000BAA0000-memory.dmp

Download

memory/4268-50-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-54-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-55-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-57-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-56-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-60-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-59-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-58-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-53-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-52-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-51-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-65-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-66-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-68-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-70-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-69-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-67-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-72-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-71-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-74-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-73-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-76-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-78-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-79-0x000000000BA90000-0x000000000BAA0000-memory.dmp

Download

memory/4268-77-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-81-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-83-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-82-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-86-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-87-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-91-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-90-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-89-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-88-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-85-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-84-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-92-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-93-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-97-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-94-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-96-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-95-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-98-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-99-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-100-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-101-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-102-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-105-0x000000000BA90000-0x000000000BAA0000-memory.dmp

Download

memory/4268-104-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-103-0x0000000007860000-0x0000000007870000-memory.dmp

Download

memory/4268-106-0x000000000C980000-0x000000000C990000-memory.dmp

Download

memory/4268-107-0x000000000C980000-0x000000000C990000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads