Overview
overview
6Static
static
1Ryanherric...IN.rar
windows10-2004-x64
1Ryanherric...IN.rar
windows11-ltsc_2024-x64
1Ryanherric...re.url
windows10-2004-x64
1Ryanherric...re.url
windows11-ltsc_2024-x64
1Ryanherric...re.txt
windows10-2004-x64
1Ryanherric...re.txt
windows11-ltsc_2024-x64
1Ryanherric...on.jpg
windows10-2004-x64
1Ryanherric...on.jpg
windows11-ltsc_2024-x64
1Ryanherric...BG.mov
windows10-2004-x64
6Ryanherric...BG.mov
windows11-ltsc_2024-x64
1Ryanherric...BG.mov
windows10-2004-x64
6Ryanherric...BG.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...SE.mov
windows10-2004-x64
6Ryanherric...SE.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...BG.mov
windows10-2004-x64
6Ryanherric...BG.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...ay.mov
windows10-2004-x64
6Ryanherric...ay.mov
windows11-ltsc_2024-x64
1Ryanherric...) .mov
windows10-2004-x64
6Ryanherric...) .mov
windows11-ltsc_2024-x64
1Ryanherric...OG.mov
windows10-2004-x64
6Ryanherric...OG.mov
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/07/2026, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
Ryanherrick_ULTIMATE STARTER PACK_AIMERSHIN.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Ryanherrick_ULTIMATE STARTER PACK_AIMERSHIN.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More Resources Here.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More Resources Here.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More free stuff here.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/More free stuff here.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/Pls show some appreciation.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/Pls show some appreciation.jpg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- CRT LIGHT LEAK BG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- CRT LIGHT LEAK BG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK BG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK BG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- LIGHT LEAK Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- NOISE.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- NOISE.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT 2 Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT 2 Overlay.mov
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT BG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT BG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM 2 Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM 2 Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT FILM Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT NOISE Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT NOISE Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT Overlay.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH- VERT Overlay.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT BG (BLUE) .mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT BG (BLUE) .mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT OG.mov
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT OG.mov
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Ryanherrick - ULTIMATE STARTER PACK/ESSENTIAL OL/RH-CRT BG (BLUE) .mov
- Size 16.2MB
- Sample260724-c2sbaaeb99
- SHA256 da8ea8871f53811e882601fbd89e92b7934a38671d7053e76814be845fef6b9e
- MD5 e317ff7936e7e099c377bd6f281e402e
- SHA1 68d317b029ed499cf6c8e4a1166a353c2292fc21
- SHA512 6e1b1671c2386ce134f870e09330dfc448ebffa19bdf8645e202a36bc4f7f460f0a43bfdf214affbfbea681377da57b4aad1e7736cd118af0d891e52890876b9
- SSDEEP 393216:CDjblcc6ISf5+OC67PFmGfoqDNrwb5sm4SqQ0cYQf8RkHf:CDcLC6roxb5sm4S8Yf1
- TLSH T11D0733928BF78C0BCCDFEB767425154D2D30FABA4485E8933F2652DE183AD2859D341A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{1BF0650E-06D3-4F50-88A5-8DC1CCEFB09E} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 1340 wmplayer.exe Token: SeCreatePagefilePrivilege 1340 wmplayer.exe Token: SeShutdownPrivilege 4668 unregmp2.exe Token: SeCreatePagefilePrivilege 4668 unregmp2.exe Token: SeShutdownPrivilege 1340 wmplayer.exe Token: SeCreatePagefilePrivilege 1340 wmplayer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1340 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1340 wrote to memory of 556 1340 wmplayer.exe 84 PID 556 wrote to memory of 4668 556 unregmp2.exe 85
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Ryanherrick - ULTIMATE STARTER PACK\ESSENTIAL OL\RH-CRT BG (BLUE) .mov"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 640KB
- SHA256 617505ca972055594467466b3d260e90eb3b79c69d92dcdf6f31824f4cf4fc32
- MD5 044c2779f9be77b3688e8c38e51adc51
- SHA1 2721102034240db7420c9ba69356b64a14aab94a
- SHA512 5b1350a9920041a66ba1dc9cdea3c378ede7b11a9cf572c234707b0fa0dde82c3909b9b6b701713ddd6de043350464316cb0d8ec1e13848991fc4b3ffe22ab29
- SSDEEP 768:v7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjPc:59tQeoVYocxYCutFCJGAKt2hZC
- TLSH T1D2D41D3BA470A098DF3C35B2E2AD6B8CBD71641A12E006411F74B57F7A337D8DA0A5E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 3464023b9ad913d235824b13764cfa301b5f7a73b89bc715b4f41bf6cb1557c0
- MD5 f92ea82e0f19bfca5546bed39c92bc05
- SHA1 08a2dd05b64cd0093a866505a8dc91397ed9d453
- SHA512 78ec7c9af0e99ab7bd251fd911b92b095b1b39f3125be4aed0f119d31454f982e4472ac8820298f97bcf4842faf024720fd027a3388e9e8686dfb6946e8e2712
- SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba+:rZP2tFP3vqY8fqEMrTaBacg
- TLSH T1FA257537D190B0C5CF2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 7aee2692c3aaadf8e7552515f05c7a1dc44b19cdcb3c5ac767e6c25b39dc82a3
- MD5 8ac9e35699e86ce5fcf09f2bbe342d7d
- SHA1 ef75f7e1d618d44ebd31d6f883e74f348a0d1ac8
- SHA512 88be7944d96d067ae7f399c32cda73eff8e2942220ace42b9a57e415371b358e4ffd6c0c31ea56376a24613437322242c43ad4d62aea24b4db83078d55349f0d
- SSDEEP 96:PbMDnkSutgmu3V7NZQltnNXtMUMUstS7XtXUMbstQUMlst9OXtGL2tPLXtNtwAtk:PV6FvnqnFnC
- TLSH T10D63E72156E45A4BF3FB2E716AF679121E3B38A25E79D28D0314824D0DB0F59DD30B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
- MD5 5433eab10c6b5c6d55b7cbd302426a39
- SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
- SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
- SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
- TLSH T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 ed7ff9227a6185d144c6bd12ce14db48a856825d4b818a2a265708420a1281e7
- MD5 37833111486d967c6d6b5a0d1f6605d9
- SHA1 cb6be323f073134a5b9e3eece6a28251d62df0ac
- SHA512 86a1d00adb3dcabc6f2b6845355e57137055088a0887d26626ba6f52ef19b7aa4a1d8b1334eeb60b5bb8f1f72d791a28b19d1eb256bbf00851a64f02ea348931
- TLSH T1BC217C5B1B8ED47089E01BE75DEC8E25737B93CA43A0D065734DA039880212D9B3D56D
- MD5 SHA1 SHA512 TLSH