0481cc0ce709762dff3ca3e27945b8ae3d584dc35665b28ec7dede6190a42677

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM Overlay.mov
Size 888KB
Sample260724-c2sbaaeb99
SHA256 0481cc0ce709762dff3ca3e27945b8ae3d584dc35665b28ec7dede6190a42677
MD5 464b0fc8a600764b1a06b2f5ca98b223
SHA1 2e25a28296472246cfa71e640d5c3ffc13858718
SHA512 4702db0173ff99f71696f7863eb27fcbd79788f41af4cef81810ee8d14a55294d8d73d97bcbe9abd92108119b777a2ca95bf5515e4c6ef8e70f4590edfc11456
SSDEEP 24576:d2IF3Qn3vX5fWJiapiDuAgC4+Vue1dh+S82r:d2o3Qn3vlcCv/1PeI
TLSH
T17D15333ADB49628EF819F3FC96C53B2A3ED7D6789942D0A9BC24E9980C3707354F8541
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{4B4B17B6-0131-4272-B83F-6213E87F2010}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4604	unregmp2.exe
Token: SeCreatePagefilePrivilege	4604	unregmp2.exe
Token: SeShutdownPrivilege	3992	wmplayer.exe
Token: SeCreatePagefilePrivilege	3992	wmplayer.exe
Token: SeShutdownPrivilege	3992	wmplayer.exe
Token: SeCreatePagefilePrivilege	3992	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3992	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1652	3992	wmplayer.exe	82
PID 1652 wrote to memory of 4604	1652	unregmp2.exe	83

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Ryanherrick - ULTIMATE STARTER PACK\ESSENTIAL OL\RH- VERT FILM Overlay.mov"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 512KB
SHA256 5f785ceee7336194384e68adb44509ee2787857786c15b58f054024543b423f3
MD5 b329979a534a47e4381448265b867bb0
SHA1 8623145d1f06430662a2304e50cff646b7551d2e
SHA512 b2359a8740387142a603e3b84e6da9771f67eda3346b60a7cba0a52882ea5f8eca0abf8006143f0975ba3617b26897c3fe22822852a210883c213a20c8fb8346
SSDEEP 768:v7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz9MjxngbCjPsgTVXRi7c9zyHM:598eoVYocxYCutFC
TLSH
T117B42F3BA470A098DF3C35B2E2AC5B8CBD72641612E006451F74B57F76237E8DA0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 3c5d359fb0d909c1234a3db39eb4f4e35d815f2de6f6c2d6e9c05eb27c1ce6f2
MD5 93b031c1aeb20f2596fc2eb2149020fd
SHA1 f3130fe915b35343b8c0f153ccefae9a2b735b92
SHA512 28d3de3a0adb58288c9978614ea9411758099471628fec2300eb3e0d026165cf53baf2be580a82861f283d4f55999b2b9181354279b4bafaa0b49be5d7e2bb2e
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbak:rZP2tFP3vqY8bqEMXATaBacg
TLSH
T1BB258437D190B0C5CF2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 e8eb253de36e55959847b6d526c91f05ca55a41c794c34d4c94f907eea604452
MD5 62e19bda29a48410191035c5bb9c77b1
SHA1 fd8200826f89ecdff4d094514d5455214fec96ae
SHA512 2927a5647640fa4ee2da280308789c54b8e2ac67966967591fa3a652523b374a967a861f80c68fd280f818de64417c1510e5beaee11e04a3f50eb4e9c57b76c9
SSDEEP 96:ccDVZllt2NXtDUMUstL7XtgUMbstXUMlstgOXtZL2t+LXtKtVAtzt:5ZmninCna
TLSH
T14963CF7022E55A49F3FB2E71A9F656531E3A3C915E79D18D0314428E0DA1F2CEEB0B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
MD5 5433eab10c6b5c6d55b7cbd302426a39
SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
TLSH
T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 5467c1deedac65857db3328bda200ac9c7f96849977cb414c487a8da6fcae641
MD5 a58e627af05bf6fecf0f062c81d827d6
SHA1 81aa8a061ba49de50f0ca6d5f3594e68b455383b
SHA512 27314edf1e50f06c6da34879a3a575634f7c3c310029b709d6b2972d1606d7b3aef72e6c78516c45ed314d9d1547a64488d9883e6438cec80cd396125c18813d
TLSH
T12F21495B1B8DD47089E01BE71DEC8E2573B787CA9790E065B34DA039880266D9B3D46D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3992-28-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-29-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-30-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-31-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-33-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-32-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-34-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-37-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-36-0x0000000007830000-0x0000000007840000-memory.dmp

Download

memory/3992-35-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-38-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-50-0x0000000005800000-0x0000000005810000-memory.dmp

Download

memory/3992-52-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-53-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-54-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-55-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-57-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-58-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-60-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-62-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-61-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-59-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-56-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-65-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-66-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-70-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-69-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-68-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-67-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-71-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-72-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-73-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-74-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-77-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-76-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-78-0x0000000005800000-0x0000000005810000-memory.dmp

Download

memory/3992-75-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-79-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-80-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-81-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-82-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-85-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-86-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-89-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-88-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-87-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-84-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-83-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-90-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-91-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-95-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-94-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-93-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-92-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-96-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-97-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-98-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-99-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-100-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-101-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-103-0x0000000005800000-0x0000000005810000-memory.dmp

Download

memory/3992-102-0x0000000008150000-0x0000000008160000-memory.dmp

Download

memory/3992-104-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3992-105-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads