Overview
overview
6Static
static
1[TakeMetal...6).zip
windows10-2004-x64
1[TakeMetal...6).zip
windows11-ltsc_2024-x64
1[TakeMetal...o).mp3
windows10-2004-x64
6[TakeMetal...o).mp3
windows11-ltsc_2024-x64
1[TakeMetal...ng.mp3
windows10-2004-x64
6[TakeMetal...ng.mp3
windows11-ltsc_2024-x64
1[TakeMetal...th.mp3
windows10-2004-x64
6[TakeMetal...th.mp3
windows11-ltsc_2024-x64
1[TakeMetal...en.mp3
windows10-2004-x64
6[TakeMetal...en.mp3
windows11-ltsc_2024-x64
1[TakeMetal...ng.mp3
windows10-2004-x64
6[TakeMetal...ng.mp3
windows11-ltsc_2024-x64
1[TakeMetal...th.mp3
windows10-2004-x64
6[TakeMetal...th.mp3
windows11-ltsc_2024-x64
1[TakeMetal...ed.mp3
windows10-2004-x64
6[TakeMetal...ed.mp3
windows11-ltsc_2024-x64
1[TakeMetal...on.mp3
windows10-2004-x64
6[TakeMetal...on.mp3
windows11-ltsc_2024-x64
1[TakeMetal...wn.mp3
windows10-2004-x64
6[TakeMetal...wn.mp3
windows11-ltsc_2024-x64
1[TakeMetal...er.jpg
windows10-2004-x64
1[TakeMetal...er.jpg
windows11-ltsc_2024-x64
1[TakeMetal...rg.txt
windows10-2004-x64
1[TakeMetal...rg.txt
windows11-ltsc_2024-x64
1[TakeMetal...ms.url
windows10-2004-x64
1[TakeMetal...ms.url
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
[TakeMetal.org] Hulder - Verbolgen (2026).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
[TakeMetal.org] Hulder - Verbolgen (2026).zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\01. Drie Raven (Intro).mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\01. Drie Raven (Intro).mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\02. The Crowning.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\02. The Crowning.mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\03. Thy Binding Oath.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\03. Thy Binding Oath.mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\04. Verbolgen.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\04. Verbolgen.mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\05. ...And We Shall Sing.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\05. ...And We Shall Sing.mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\06. In Blood and in Earth.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\06. In Blood and in Earth.mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\07. Den Nacht Zijn Lied.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\07. Den Nacht Zijn Lied.mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\08. View From Nemeton.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\08. View From Nemeton.mp3
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\09. The Glow of Dawn.mp3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\09. The Glow of Dawn.mp3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\cover.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\cover.jpg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\★ READ ME - TakeMetal.org.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\★ READ ME - TakeMetal.org.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\★ Visit TakeMetal.org for More Albums.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
[TakeMetal.org] Hulder - Verbolgen (2026)\★ Visit TakeMetal.org for More Albums.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target [TakeMetal.org] Hulder - Verbolgen (2026)\09. The Glow of Dawn.mp3
- Size 11.1MB
- Sample260822-pd732stfpb
- SHA256 03d59529692ec2db459369086285173e71eafb0797966a1a6234aa776fa61f36
- MD5 efd3edce7cfe745a04eaba249af0e5f6
- SHA1 1f20f14d9000f79593a5df8bb0e6427d02ccd300
- SHA512 4e9fad255e2125e29345a16a8202378d582ba65d280d805fae7ccd4b7ffcd2703be11000156f267a3efdad753d4311b8e84457d9486a5a43f1b3902ae5fb41c8
- SSDEEP 196608:bC8T5TVv64C2hCR9qj1cWsDSbas3d6h8G0upYb84:fFBv51tj1xnb5hBu2
- TLSH T1CAC633A2E2247235E7B126B76CB73000FA230D6D6C711BE47511B2714AABB54AFF7907
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{2AE79020-86F2-470C-BAA6-4B5D3FDE7301} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2124 wmplayer.exe Token: SeCreatePagefilePrivilege 2124 wmplayer.exe Token: SeShutdownPrivilege 1392 unregmp2.exe Token: SeCreatePagefilePrivilege 1392 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2124 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2124 wrote to memory of 3168 2124 wmplayer.exe 85 PID 3168 wrote to memory of 1392 3168 unregmp2.exe 86
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[TakeMetal.org] Hulder - Verbolgen (2026)\09. The Glow of Dawn.mp3"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:1828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 854ef640c553eb3e3c0870d93a80caa774b28281495e809f04b52a47cf165b90
- MD5 a9fcbc111ad25a580f0530aa6dfbf814
- SHA1 0cc441e93a0819e2d290a63055679be0e2274656
- SHA512 26305a6c6cc229f0a5e27daf7b31f18d320043350054f83066ff238453736d9cd7922d66154794f24390b457c6966db5820840cc5fb3bab61f5f183104d8befe
- SSDEEP 6:h+1E3+e9XplsknAxtg53kqijiPqZUcHWbw8I10cAe:I1E3+e9XwknArgpyiPqqcR0
- TLSH T1B253A701E67CD5B6EC40867EF19307836372F4545E5EFF1F312D687D0E02695A9B6190
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 a0b9b134fa02243d818a02c672f77cce5de271465e9c625c49597cab913e9056
- MD5 3c371f74f6b67ce3239c404cac3ec7e5
- SHA1 989576050b406611d1c92f8547295f0c3d9453b9
- SHA512 82e54217f7c0d130ff2c2a4825f87897be43f3e637d6bb741a37326becfdf67fc8c3ef47292a65cdaf3514a529839d6d597a0cb98c124294167843515f18dad6
- SSDEEP 768:40aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:mZP2tFP3vqY8uqEMSTaBacg
- TLSH T12C258437D190B0C5CE2CB171E9ED8F08BA63B10B11A052465FF8A57E7A633D99D0B1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 ae8a86a3fd154e8fd149593c561abdaf8345f6be3a92d5cc161e94e6fdc917c6
- MD5 7c28dff7aa41337078ef11724ba081a4
- SHA1 28970ebe8a67f47cf0d87cc7c29d1d5f6cce2b9f
- SHA512 191683a74e07ae9706ba0c269a5f60b5cfc525fe28039067161a21d7a8df3abbae40a63d9f827aeb29a823b49d7cf94cdfc51d434daf87a3a1895398c5d55844
- SSDEEP 96:DCiCBC9C7oovICBCJsDltSNXt3UMUstH7Xt0UMbstjUMlst8OXtNL2taLXtetZA3:DDgYaoovIUIswnCn2na
- TLSH T15763C55523E8564AF3F72E716DF559663F3A78929E39D20D0210424E0EB0FA8DE31B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 4a71e79b44a65356fc3e0b7b75d319d97ab974992f9a73d1245a75de0fd30158
- MD5 8749493f23b3c96eea3f8d811388c3a7
- SHA1 b0caa70e5bb2efddfcd9995d90c0b37b5243ecac
- SHA512 d46040b78ed5497946e78604aa34d6dbd3b7fb5548e692c1d4a53a26c4469cde907efa9a8c2b68a06ec1accdecd8f4cd87ba87b9fcc34fa8b1171d22587591bc
- TLSH T11E217D571B4ED47089E01BE71DEC8E2573BBC7CA83A0D0A5B34D90394C0252D5B3D06D
- MD5 SHA1 SHA512 TLSH