Analysis
- user interaction
yes - max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 10:33
General
- Target 4_5780522172162251845.webm
- Size 85KB
- Sample260811-mlx7psxtbz
- SHA256 f3ee747534c0ca194f01d6d2a1e0a5610ef30d4ab885b2c0dfb8579e00f3683e
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 48 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\4_5780522172162251845.webm"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
wmsetup.log
74d7f43c1561fc1e.customDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
memory/4112-200-0x00000000084E0000-0x00000000084F0000-memory.dmp
memory/5164-33-0x00007FF69D8D0000-0x00007FF69D9C8000-memory.dmp
memory/5164-42-0x00007FF8501C0000-0x00007FF8501D1000-memory.dmp
memory/5164-4-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-5-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-7-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-9-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-8-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-6-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-11-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-12-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-15-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-14-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-13-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-10-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-18-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-17-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-16-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-19-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-21-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-20-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-22-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-24-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-25-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-23-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-30-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-31-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-32-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-2-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-36-0x00007FF858E20000-0x00007FF858E31000-memory.dmp
memory/5164-35-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-3-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-39-0x00007FF857B70000-0x00007FF857B9B000-memory.dmp
memory/5164-58-0x00007FF84C070000-0x00007FF84C095000-memory.dmp
memory/5164-38-0x00007FF857BA0000-0x00007FF857BC2000-memory.dmp
memory/5164-41-0x00007FF857B50000-0x00007FF857B64000-memory.dmp
memory/5164-54-0x00007FF84DAB0000-0x00007FF84DAC1000-memory.dmp
memory/5164-44-0x00007FF844AD0000-0x00007FF844D66000-memory.dmp
memory/5164-40-0x00007FF844D70000-0x00007FF845100000-memory.dmp
memory/5164-37-0x00007FF8582A0000-0x00007FF8582B9000-memory.dmp
memory/5164-47-0x00007FF850170000-0x00007FF8501B1000-memory.dmp
memory/5164-34-0x00007FF858E40000-0x00007FF858E74000-memory.dmp
memory/5164-56-0x00007FF84C0A0000-0x00007FF84C138000-memory.dmp
memory/5164-63-0x000001C8E3D60000-0x000001C8E3D7B000-memory.dmp
memory/5164-65-0x00007FF83EF60000-0x00007FF83F1A5000-memory.dmp
memory/5164-64-0x000001C8E4790000-0x000001C8E490A000-memory.dmp
memory/5164-61-0x000001C8E4400000-0x000001C8E4790000-memory.dmp
memory/5164-62-0x000001C8E3D40000-0x000001C8E3D51000-memory.dmp
memory/5164-59-0x00007FF84B900000-0x00007FF84B9AB000-memory.dmp
memory/5164-55-0x00007FF8448C0000-0x00007FF844ACB000-memory.dmp
memory/5164-50-0x00007FF84DAD0000-0x00007FF84DAF6000-memory.dmp
memory/5164-49-0x00007FF850120000-0x00007FF850138000-memory.dmp
memory/5164-57-0x00007FF84C2E0000-0x00007FF84C32F000-memory.dmp
memory/5164-46-0x00007FF84C330000-0x00007FF84C413000-memory.dmp
memory/5164-45-0x00007FF84FC60000-0x00007FF84FD48000-memory.dmp
memory/5164-43-0x00007FF84FD50000-0x00007FF84FE22000-memory.dmp
memory/5164-51-0x00007FF84D640000-0x00007FF84D66D000-memory.dmp
memory/5164-53-0x00007FF84E1A0000-0x00007FF84E1B1000-memory.dmp
memory/5164-52-0x00007FF84FC10000-0x00007FF84FC2A000-memory.dmp
memory/5164-48-0x00007FF850140000-0x00007FF85016F000-memory.dmp
memory/5164-60-0x00007FF84C050000-0x00007FF84C06B000-memory.dmp
memory/5164-204-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-1-0x00007FF845100000-0x00007FF8453B6000-memory.dmp
memory/5164-0-0x00007FF8453AD000-0x00007FF8453AF000-memory.dmp
memory/5164-285-0x00007FF845100000-0x00007FF8453B6000-memory.dmp