Analysis
- user interaction
yes - max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 16:29
General
- Target FUCK.exe
- Size 2.3MB
- Sample260730-tzpk2scb73
- SHA256 e11dde3ca92a6d08d6df23d01a1824bdf84e6dd86ba63d865eb6c703898cf9d2
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCK.exe"C:\Users\Admin\AppData\Local\Temp\FUCK.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FUCK.exe"C:\Users\Admin\AppData\Local\Temp\FUCK.exe"2⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\FUCK.exeC:\Users\Admin\AppData\Local\Temp\FUCK.exe1⤵
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 356 -s 17562⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 356 -ip 3561⤵
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
LocalMLS_3.wmdb
lastplayed.wpl
WMSDKNS.XML.bak
farland.mp4
wmsetup.log
74d7f43c1561fc1e.customDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
memory/356-80-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-88-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-53-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-54-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-41-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-122-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-121-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-120-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-58-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-59-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-61-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-62-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-63-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-65-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-64-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-66-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-67-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-69-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-71-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-70-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-72-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-73-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-74-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-75-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-76-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-77-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-78-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-79-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-81-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-119-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-83-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-82-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-84-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-85-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-86-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-52-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-89-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-90-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-92-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-91-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-93-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-94-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-95-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-97-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-96-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-99-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-98-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-100-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-101-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-102-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-105-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-104-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-106-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-107-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-108-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-110-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-109-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-112-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-111-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-113-0x00000000070E0000-0x00000000070F0000-memory.dmp
memory/356-116-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-115-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-118-0x0000000000900000-0x0000000000910000-memory.dmp
memory/356-117-0x0000000000900000-0x0000000000910000-memory.dmp
memory/1864-2-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp
memory/1864-3-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp
memory/1864-55-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp
memory/1864-26-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp
memory/1864-1-0x0000021FE81D0000-0x0000021FE842C000-memory.dmp
memory/1864-0-0x00007FFE9C7FF000-0x00007FFE9C800000-memory.dmp
memory/1864-6-0x00007FFE9C670000-0x00007FFE9D014000-memory.dmp