93480da8074020cab87021e61b2d85de98f8817148e5ad70ce291a7f2996ad2a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
[TakeMetal.org] Hulder - Verbolgen (2026)\07. Den Nacht Zijn Lied.mp3
Size 15.5MB
Sample260822-pd732stfpb
SHA256 93480da8074020cab87021e61b2d85de98f8817148e5ad70ce291a7f2996ad2a
MD5 410444525b56fc249a67508dbc7a7838
SHA1 45c507f26ca61d3893c6ffb37f0d209e8c525706
SHA512 076119876cf710326337bfdd562c1c2022a2b0193f7ec959e9c7d9b2c0cefbfe45f4f3dc900e85366fe47b7376f71c0a2a1a4525ef2a9ecebd661f189ae1436e
SSDEEP 196608:YG6nM5R8S8R0qDVkF+kZWj5Ymm2w6qejAUufk6RcaVHrFnrHH+HdY3SrbxCd+ZSV:Y5ni8Tm+lGLKAUufy4rHeHdYCrbMQSV
TLSH
T12FF63396D366FB7BD2AEA3726E774540BE030DAC99A113C02790F334C875A84CF65C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{464CE4CA-27B6-4F0B-8DEF-9C814B128CCC}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5056	wmplayer.exe
Token: SeCreatePagefilePrivilege	5056	wmplayer.exe
Token: SeShutdownPrivilege	416	unregmp2.exe
Token: SeCreatePagefilePrivilege	416	unregmp2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5056	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 452	5056	wmplayer.exe	84
PID 452 wrote to memory of 416	452	unregmp2.exe	85

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[TakeMetal.org] Hulder - Verbolgen (2026)\07. Den Nacht Zijn Lied.mp3"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 be062cf7d058cb58e952b2bdcde58dcb1146350943653efba03b16dc2f91e635
MD5 78daa6889fe0fc8aa324c0cffb175927
SHA1 acea507d1b0fbab5b5c9ffeb92f0da5efa47dfc0
SHA512 65b0d43ab9277d23b6e0591257535aca65fef71fdbbda6cb6754c5fddde1d95be37f63f9355c4573dbaf814619d239ab98de9b4438d4a76347174d0597d92eca
SSDEEP 3:4nallkltlsl7pl+e/lls4XplsMlE+yHj46O9/lcI1Xlldl0lcNklltlwzl4hR/m/:4u+1E3+e9XplskEvUlcI10cAe
TLSH
T1B9534C04E26057A2C404837764B60747B371B4660A59971B5135643C1C4119929A4185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 acc7001ead3bed35bef0ddea9973a516ac7effad168d44a60165468a5ce3cad8
MD5 e16bd066e7e19f93d2705efe75707dc2
SHA1 837288ee2d64fbd92a6ef54d301b4c51be6f4d20
SHA512 d95a54fe71f9eebdb06129c2c6927e41c041a0c46dfed3424d64d065c37287f44804072f7f2135a6d07ea84591d094ba8bc6462adfebebff0425f33c219df273
SSDEEP 768:10aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaU:zZP2tFP3vqY8+qEMz+TaBacg
TLSH
T15F257337D190B0C5CF2C7171E9ED8F09BA23A10B12A052465FF8957E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 e4cec02b4f9025c0ecdd6413384b5d0dace303e754db7cdad80c1947c8b47c75
MD5 32e8413cfeccfd3853f634064d2c175e
SHA1 24cbe27a3fd212627dfd5b0c99da78382333a08a
SHA512 24c80472364d89ff88570b214751cbda11e6f2690d406940cb8e74d223aac0b35399d75f0709da7c70a50607e51ac8d10a0f216753912f24bf85c4c6bbf2d897
SSDEEP 96:YoN3nSElt5NXtSUMUsto7XtJUMbst+UMlstTOXt4L2thLXtjtqAt6twl:fmnKnbnS
TLSH
T18E63E16423E8464DF3F72E7469F696125F3A3891AE39E22D022142DD1C70F28DD31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 d0ae0f389aa5fc26f6feb669ea8603b17ea765172900f394d8ee770e5044ca0a
MD5 61a37e0b216f6451a3ad2c397859cd37
SHA1 7eb37d89246bfddf3473e3177530bbc92b2fa1b6
SHA512 061d323f28e6ec344222ef063dde481102ce481593e1fed9bf85d22dad9cbfbb33a015324219d076c79db1ef16fc60091f22575270637d73e3f5f0149708991c
TLSH
T179216B5B1B8DE47089E01BE71DEC8E2573B7C7CA83A0E065B34DA039480252D5B3D06D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5056-30-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

memory/5056-33-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

memory/5056-32-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

memory/5056-31-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

memory/5056-34-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

memory/5056-35-0x0000000004B60000-0x0000000004B70000-memory.dmp

Download

memory/5056-39-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/5056-42-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-43-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-44-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-45-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-46-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-47-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-49-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-48-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-51-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-52-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-50-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-53-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-54-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-56-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-58-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-57-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-55-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-60-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-61-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-62-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-63-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-65-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-67-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-68-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/5056-66-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-69-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-71-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-70-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-72-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-76-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-75-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-79-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-78-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-77-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-74-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-73-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-80-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-81-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-82-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-85-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-84-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-83-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-86-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-88-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-89-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-87-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-91-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-92-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-93-0x0000000007A10000-0x0000000007A20000-memory.dmp

Download

memory/5056-90-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-95-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-97-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-96-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

memory/5056-98-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-100-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-99-0x0000000009630000-0x0000000009640000-memory.dmp

Download

memory/5056-101-0x0000000007F70000-0x0000000007F80000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads