Overview
overview
6Static
static
1Wick10k Ze...ts.zip
windows10-2004-x64
1Wick10k Ze...ts.zip
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...rd.wav
windows10-2004-x64
6Wick10k Ze...rd.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ll.wav
windows10-2004-x64
6Wick10k Ze...ll.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ey.wav
windows10-2004-x64
6Wick10k Ze...ey.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ad.wav
windows10-2004-x64
6Wick10k Ze...ad.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ng.wav
windows10-2004-x64
6Wick10k Ze...ng.wav
windows11-ltsc_2024-x64
1Wick10k Ze...no.wav
windows10-2004-x64
6Wick10k Ze...no.wav
windows11-ltsc_2024-x64
1Wick10k Ze...ad.wav
windows10-2004-x64
6Wick10k Ze...ad.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
Wick10k Zenology Bank @wick_kid_beats.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Wick10k Zenology Bank @wick_kid_beats.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Sweeper - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Sweeper - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TechnoVirus - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TechnoVirus - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/ThrobulaxMod - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/ThrobulaxMod - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TotalDramaIsland - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TotalDramaIsland - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapAHolics - Harpsichord.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapAHolics - Harpsichord.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapBell - Bell.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/TrapBell - Bell.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Union - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Union - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VaporizeSweep - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VaporizeSweep - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VoxChoir - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/VoxChoir - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WantItAll - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WantItAll - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Wants&Needs - Synth Polykey.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Wants&Needs - Synth Polykey.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Weary - Lead.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/Weary - Lead.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WeatherReport - Pulsating.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WeatherReport - Pulsating.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WiseKey - E Piano.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WiseKey - E Piano.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WorryBoutNow - Lead.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Wick10k Zenology Bank @wick_kid_beats/OneShots/WorryBoutNow - Lead.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Wick10k Zenology Bank @wick_kid_beats/OneShots/WiseKey - E Piano.wav
- Size 1.2MB
- Sample260802-r2taxabr21
- SHA256 df650a0b0e856d67db1476241396627e7d9b55087c0e7e145de05c8060b6440f
- MD5 9d2da6d832a5f17a34bf06f9ebae1a3b
- SHA1 b36e262b3c038c5d2684111beec2575286d034a3
- SHA512 69c455adbf7dcddc45510ce638fede371221260a7413e731c9fddc8abc801d0c97dfc1adbed197304307d816f84931b16613fec30797e7ac27addf4313a2fe79
- SSDEEP 24576:mSqFMwyACHtBL4oJvZpyFAoORGB9Nhkn08WkOoOm094luzGGyhOpBo6QjaS:mSqFMDA+tBEkbdpMB9NS9ao0ylPx4TyX
- TLSH T1C24533B57093E147F06793778CC21A8C2B5B3852E9B744DF8435B19848AEABF9F1A340
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{910B5AFE-BECF-4592-87DF-0593A15AB734} wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4884 wmplayer.exe Token: SeCreatePagefilePrivilege 4884 wmplayer.exe Token: SeShutdownPrivilege 3576 unregmp2.exe Token: SeCreatePagefilePrivilege 3576 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4884 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4884 wrote to memory of 4076 4884 wmplayer.exe 83 PID 4076 wrote to memory of 3576 4076 unregmp2.exe 84
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Wick10k Zenology Bank @wick_kid_beats\OneShots\WiseKey - E Piano.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:3196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 339877790dc0c6f8d64784a11d972c1037bc2639f4412956193136562100bca9
- MD5 53a514d7a0e1eb94fbccd7c9af393c94
- SHA1 5c632e619fa18c375ca89126c89f614a87cd086e
- SHA512 9bbe6a9aed6c25f413575b9219319f59c9611cc083509139fc65a1d5e4527dd16153a9cda351bc9d5fcb1a516a2866a2ea47f37eae022c91f155b436f05cc9b3
- SSDEEP 3:6/nallkltlsl7pl+e/lls4XplsMlhlcI1Xlldl0lcNklltlwzl4hR/mll:Ku+1E3+e9XplskQI10cAe
- TLSH T139539204E3609962C8048377A4EA0B43B335F4690A1AEB1B602964382C022D92CA0181
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 c93db4a56cacb59627421facd21f9488399d1c828d7c1d81be6627c34f9d8b1c
- MD5 0ed12c09aa2feaccb53369fbd66dad75
- SHA1 1346c6c6ca4b72b7a7ab7e0a372a223827f57548
- SHA512 51e518020f8ce7b4f1b57a41a20e1b85b2a69fe7bf9a88e11f6f2d33b047bf89200bc94a901381b6f580e620a845af36a37916573654007fd3628a262251a03e
- SSDEEP 768:o0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaV:WZP2tFP3vqY8bqEMATaBacgwQ
- TLSH T17B258437D190B0C5CF2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D98D1B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 e56bd5b0cdbe634d92cbaa29c0e000c815a29d90fd03b13913a00d3c5aba71b6
- MD5 7f8d473f0e4643c597b735cabab9e1eb
- SHA1 55772966a4798e8ee1bb32b965f573aaae16a812
- SHA512 1380faac41f225d0bed318d824d8ec93ac8b7d6d06c7a4850952125635645776b0ce01bbe4f575cf28379b39bf35d21fef423d09ce66e96a15d67dcbe1c226d0
- SSDEEP 96:vBqd+xBl9e2lt2NXtDUMUstL7XtgUMbstXUMlstgOXtZL2t+LXtKtVAtztL:vg8x5edninCna
- TLSH T139630490B2E9565DF3F72E7179F656172E3A38906E3DE24C0214425E2D61F6CDA30F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
- MD5 5433eab10c6b5c6d55b7cbd302426a39
- SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
- SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
- SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
- TLSH T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 893ac5d5250510393add5f8f5ea0a470f79b0edc1344ba550bcabf67b632d360
- MD5 122351a11c244ff01b9c0172320fd425
- SHA1 b0021700b1600552df3bd2376e2f806fe5bc2ac3
- SHA512 da8ab9e9acb9e1667933bb4022ecbfa9b86d7207ddbd89facfae1031eac576112158f4524c3f9cc304c7df67cf8f323df45b070f8620db4aa93794107b02c602
- TLSH T18D21795B1B8ED47089E01BE71DEC8E2573BB83CA8791D0A5B34DA429480222D5B3D45D
- MD5 SHA1 SHA512 TLSH