cb5c61609d13b1bd10e7a91ce5776311892aae6acb299468824ea2a8cfe6b9b7

Analysis

user interaction
yes
max time kernel
16s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_9854.mov
Size 1.0MB
Sample260910-x87prsvdph
SHA256 cb5c61609d13b1bd10e7a91ce5776311892aae6acb299468824ea2a8cfe6b9b7
MD5 870098ac292f15e7e201b6faace29138
SHA1 463b645d0e7cf6e21adf365ff5e3847d531064b7
SHA512 75890924392f910f99fc364a7e2b2c6e8411aaa3598ed250d59d22a9d3826e77a8bf1b155797d70791acf285680074c14020e6bd7e67d953c54f3aa64f60198e
SSDEEP 24576:Yjgk2QyRckf4jh9jTVjw2p+U9AQNQKzAiIbJ3tBI8n:Y8ZQWvgjh9hwu+U9AQNxzWt9B1
TLSH
T1E235335027A04725E26A33F83B3767CC2E719DB3460D50FF185952AB1B9AADCEC16DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	4540	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{BC9CEF20-84F0-4A13-BC3E-9EEF88BA6396}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4540	wmplayer.exe
Token: SeCreatePagefilePrivilege	4540	wmplayer.exe
Token: SeShutdownPrivilege	1680	unregmp2.exe
Token: SeCreatePagefilePrivilege	1680	unregmp2.exe
Token: SeShutdownPrivilege	4540	wmplayer.exe
Token: SeCreatePagefilePrivilege	4540	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4540	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 2216	4540	wmplayer.exe	86
PID 2216 wrote to memory of 1680	2216	unregmp2.exe	87

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\IMG_9854.mov"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 2204
  2⤵
  - Program crash
  PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 4540
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 b7c30e4f1dfc8bce954e737b7b310ab4e9b687128ce8d6b9d1eb1d70ed8178f1
MD5 84b4aad4c8ef3e090937233d1729036b
SHA1 b645e1f38b34d7413d646312f3b26cec4ae96487
SHA512 1a328e56da6b7dfd1828eac56c7f07728b3493ff4a1ed3c2424a8944e263b912e194bc49dd8fcba7e429e448fe9828eba6cbdf89f9b544fe019e6f8a3787cb3a
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbak:rZP2tFP3vqY8uqEMeTaBacg
TLSH
T17C258437D190B0C5CE2C7171E9ED8F09BA23B10B11A052465FF8A57A7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 e6762ebde074f19efad5626269a80c6700156214c8221761c7ec3fec6c798879
MD5 082413b53aea93a5d4c141c060dfd76d
SHA1 083d84d162263ff007c0b3839894bf1bf02323bd
SHA512 0e480d024f97745c283fe6e2d1b1b5c73200b30b144ad4a41bad67d6d02f3324303fd87ebf36dc4e9e81296fa75ff8528d7a421ec4fc88873859a9e61dbe2ed0
TLSH
T1DF2149671B8DD8708AE01BE71DEC8E2573B797CA9390D0A5B34990394C0252D5F3D06D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 b3d1acad649e411c6c8726c140c174c992bcd495714dcae3bd3aeb9601545e16
MD5 9f8f3f3631678cab10c81a1c9cb66247
SHA1 2ffabdc9f2e3edd078356e0348615e646059aae4
SHA512 3cb1ab7fa29a49d25b924a8e6a92f1810ef501f7d3475ea4d4dcab9586cd5a0ffc924625334d0ffd7a9489e98497858dbdde694da35f657a49b78eed6b71ebc9
TLSH
T12131C25063D15655F1E34572FC3B7B027FA1FC06AB1B9A8E014C91590CA5704BA2BB6B
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 8a392130a1aa714156a8e0475508fae3436313c10fd0eeb7f6983bbff42bd04d
MD5 149eeacbb890a042b729f7b74b5f4452
SHA1 f8bf81f0ffe76dcf740e455d30c8f43671637dd6
SHA512 d7c55562cc8201d53ce7601fad6713374e1cf8b82a3c19b74553eeaa640fc28cf46476846f16062b4923307967b749cf88653bd8575a80bd6d7a84ba410ad240
TLSH
T1F071021063D15256F1E24972FC7B7B02BF61FC06AB1B9A8F014C509608A5B04B97F76B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4540-35-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/4540-34-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/4540-33-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/4540-36-0x00000000056F0000-0x0000000005700000-memory.dmp

Download

memory/4540-40-0x00000000056F0000-0x0000000005700000-memory.dmp

Download

memory/4540-39-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/4540-38-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/4540-37-0x00000000056F0000-0x0000000005700000-memory.dmp

Download

memory/4540-32-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/4540-30-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/4540-28-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads