a3829787be1d3b726b36f575ffa52a14dc6ce659c3bf46beba061e55c2762976

Resubmissions

07/09/2026, 14:04

260907-rdlk6abj9t6

07/09/2026, 14:02

260907-rb7evayarc6

Analysis

max time kernel
112s
max time network
113s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
07/09/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Amor En Silencio, Juan Carlos Coronel - Audio.mp3
Size 4.6MB
Sample260907-rb7evayarc
SHA256 a3829787be1d3b726b36f575ffa52a14dc6ce659c3bf46beba061e55c2762976
MD5 ec6dc434ff92225b9f7c435c7a80ac05
SHA1 7cc4d167daab6f1c691c3198580792e358f77022
SHA512 d1b5eb6ec975356df0e29e88e4945141726a76cd72872406619dce80daababdfddda0b942ab1b27494a78c9e514a65c3ffc442c62bab788599862617ade2f35b
SSDEEP 98304:bHEB5GS8CMVO7ypmT8iOzP1EEqeErdAFimcdIYtBX:rEd8CMkypmTp+3Eyv0F
TLSH
T1F4263361E205DACFC98513376F876FD9BB834E2C25009BFAB952DBF7E1F511028A6214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3604	wmplayer.exe
Token: SeCreatePagefilePrivilege	3604	wmplayer.exe
Token: SeShutdownPrivilege	1300	unregmp2.exe
Token: SeCreatePagefilePrivilege	1300	unregmp2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3604	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1948	3604	wmplayer.exe	80
PID 1948 wrote to memory of 1300	1948	unregmp2.exe	81

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Amor En Silencio, Juan Carlos Coronel - Audio.mp3"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 128KB
SHA256 033eaea6c785f740f5bb8091083bfab92474be763d843157454734f816f9baeb
MD5 26f6dddbd974c102295796fdb0501341
SHA1 be1d5229eef8aa98a10085918f8a3aab0f663146
SHA512 d3c8efbab97efc0f820837098129ae388491cda3803c867181a19b5147489f2464ff9a8db2de029cf63ca293c642369381014ff98876ace2cfd3c0a0a99296e9
SSDEEP 384:oU0wm+WNyEXGjGlomJubtEGlfWSBaq+i9KPms80ZukjWBMePmI88Ja88nHJ+oycJ:of0aleDxcg7KGVp3zT13VuI61H
TLSH
T1D6D3C827E6D0B5C1CE1CB530E2DC1F48AA73750B00982A475FF8616DBA633C68D571EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 234e833f2315b7a21ed06a2796f10c6028e4146324b0d09732d59421fb6492a1
MD5 b2a209c28ea8deb700dd01c5639f6f54
SHA1 98c38e1a42bdfd096ca56bcb626985d38ad0f807
SHA512 930840ff3745e904ab837341099586d24f17ed90048761313cad0461dbdb3b095a9b26491b9b0d7690bfef2170d10c18a7a9f297f5e4cf914717460fc945f9c3
SSDEEP 768:I0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbar:2ZP2tFP3vqY8kqEMBoTaBacgC
TLSH
T1F8258437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A533D98D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 94137623c06fc59d6d3852a73af8fd8cf2312a9a6c2d15fceaf32d99938ce0dd
MD5 b0bf9d6436d4ecaa1b001bb6bb7b8c0c
SHA1 7441d684a9e8381ed85acf26586d9650ee037365
SHA512 7c2542c221ac3c4e1505d9dbcc6ca405f10d472a3984066b0dc4de681ebd3e3d446f1b00ddb1c3504bc651352078722c2245dfff5b7f406ca4982fbba7f4c849
TLSH
T1C9218B970A09A4B0DDA007BB79DCCA35B3BAA7CF0764D016B24EA81E441613DB73D16D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3604-28-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/3604-31-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/3604-29-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/3604-30-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/3604-33-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

memory/3604-32-0x00000000049A0000-0x00000000049B0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads