5ea20861824bd2d0e40af1880f25a7df28e6753271196c9524cbd880791dcdb8

Analysis

max time kernel
898s
max time network
424s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Arcane/Settings/1.mp4
Size 39.1MB
Sample260727-w6arkscf48
SHA256 5ea20861824bd2d0e40af1880f25a7df28e6753271196c9524cbd880791dcdb8
MD5 71c045c11d7746b30dbc9aa64969f5ea
SHA1 7a2df2d1abd35d9f9064577378a4e9f32b614320
SHA512 0740c29bc749b217469f05a2e5713b7278e67508565e51a179ab0eaa87c96ca31958b121c37c14a1efc394d279ad526587eb231ce5b0ed0c975d4cc9f3554a5d
SSDEEP 786432:hp32d0UJPJ17uqHJbuhUVj2QgfZ4W6MjYYJYEA:D32djPJ1LpgUPgfZ1f9JG
TLSH
T1BE9733B0B7FD5256DF3553BBC6EA53450470F2290F62C3C7588D4BA16CA62ACAD831CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{1BCB4F88-3C7F-433A-800C-1E59CF4F4358}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4336	wmplayer.exe
Token: SeCreatePagefilePrivilege	4336	wmplayer.exe
Token: SeShutdownPrivilege	4208	unregmp2.exe
Token: SeCreatePagefilePrivilege	4208	unregmp2.exe
Token: SeShutdownPrivilege	4336	wmplayer.exe
Token: SeCreatePagefilePrivilege	4336	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4336	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5512	4336	wmplayer.exe	81
PID 5512 wrote to memory of 4208	5512	unregmp2.exe	82

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Arcane\Settings\1.mp4"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 17796253bbdb68d730a6d10c7092c7fde0e22f9a68704195016dc1e7ab3ccbb8
MD5 9bcb76365b1099e01c7afb4beeaf0eae
SHA1 5a0367305f19dea844714e817be62a6e33287900
SHA512 25e51b59086e584a899098d58222fe86848826fb9e15b86ea6afd811c2c0221274a68c5694e487749e9aa64ae98e11b09311629d2050940b04d48f90fdb92ddf
SSDEEP 3:Fe3allkltlsl7pl+e/lls4XtXMlejtvPOlOdgu8QX5ARrPdgKM6pZ/EI1Xlldl0U:L+1E3+e9X9keiOdHzX5AtaYZcI10cAe
TLSH
T1AB531204FA785722C419837358A543436372B0A6455AE75A156568386D1239878F06C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 2615f531fac775ba2e1c77dd251ed8d562fa7fb0e32993c8d1ef60b44c7a6ef4
MD5 53d31a8e55531f1aa04e87657117b3b9
SHA1 ca37ff50a1c6c4c44bb7346be1f746753aaf9adc
SHA512 fdb6347261c8af937651e69157c38b2bf3370ac2c8b08b54aa8cb2942e11a3420efd4d1972722405d145ef41cf9c342ad07116e18e3deb112231d2e614809c14
SSDEEP 768:u0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaX:AZP2tFP3vqY8iqEMsTaBacg
TLSH
T1BB258437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D98D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 9a9cc8569b16daf3c10be481f60b5013f03f3136a4360caab23df8b2763d6d15
MD5 6b08488932d450d804de3e45784bd05c
SHA1 213313e9fd7d74d7ab264981311bea96dc48512e
SHA512 4af30177d2c5ba15e8633f4b998b2833d475aa02f93b95bdc0c6f563394bf8e3d1d324175ac8d20219e20b867432b5fd1b93af12efdb42a924a865fcbf25457f
SSDEEP 96:f8nCXc/bdwXohpCrAyt3xtqa3mO/G1CltnNXtMUMUstS7XtXUMbstQUMlst9OXtQ:fLdt1ynqnFnC+N
TLSH
T18E63052553E88A4AF7F72EB069F665A61F3A78915E7AD20C0214524D0C70F3DED34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 826b011f26bcd310de3ad3fa3590c9649ebe25c5d24439ab701d87cea303455e
MD5 769af1f0f0ddd5884cc486ed979b1872
SHA1 46fbd9ea2f96b9a88a927f7bd659bbadcffca6aa
SHA512 b8e6a8d881a0a4f9881f4fe2849bd61462cf300aa97119dcbf51dba75ae1827b9d3557cb43c738dce6aeb5ad8a15e29918070cd73df525a8969e98c307ef690f
TLSH
T13C218E970A09A4B4DDA007B769CCCA3573BAE3CB5758D026738AA81F480613DB33D16D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4336-35-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/4336-30-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/4336-34-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/4336-31-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/4336-39-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/4336-38-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/4336-37-0x0000000009B60000-0x0000000009B70000-memory.dmp

Download

memory/4336-40-0x0000000009B60000-0x0000000009B70000-memory.dmp

Download

memory/4336-36-0x0000000009B60000-0x0000000009B70000-memory.dmp

Download

memory/4336-33-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

memory/4336-32-0x00000000048A0000-0x00000000048B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads