a17ae2c0a7687f811692bfa8a06b85dc83596e0e4a47a0ecf49e3085e9a04b06

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16 16-25-56.mkv
Size 17.1MB
Sample260916-weamhatcng
SHA256 a17ae2c0a7687f811692bfa8a06b85dc83596e0e4a47a0ecf49e3085e9a04b06
MD5 f30deb77d183aea769568a33c3c5a378
SHA1 6caf935a4ab1a6e5464fd2d76cdb0376cd446a9c
SHA512 8ecd39a93074ae246da2b58ca895aeefcfe4e235c15a785b5f202ab499567d545087bbbbff1de4fb24e49b73c937536ac934830a69ebd7ee635ce2dd5d819f85
SSDEEP 393216:OfIDElL2niZbB5ndHtLeqtuqpwfVnFK8tN480bQ1J9oF1eyBEjpq41FOhfC8sGI:OcEnbB5dHVeqtulf1I8XD40JQZYR1Ehq
TLSH
T11D07334639F99F67F6A67B30484434B0BD710B1B1421B3DB9CD38E2368AB8DA6E513D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2460	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{765CDEC8-B8E9-4C93-8A14-110609CD890D}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2136	unregmp2.exe
Token: SeCreatePagefilePrivilege	2136	unregmp2.exe
Token: SeShutdownPrivilege	2460	wmplayer.exe
Token: SeCreatePagefilePrivilege	2460	wmplayer.exe
Token: SeShutdownPrivilege	2460	wmplayer.exe
Token: SeCreatePagefilePrivilege	2460	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1120	2460	wmplayer.exe	88
PID 1120 wrote to memory of 2136	1120	unregmp2.exe	89

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\2026-09-16 16-25-56.mkv"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 2208
  2⤵
  - Program crash
  PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2460 -ip 2460
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 7e2806b3c8d161f5dc0d5cff122e2059a317b512e0dd0c58464840c95908e195
MD5 d77aeb5b2646f0c24489173ea042e978
SHA1 86024f70f7113b0e35c0b5f915f8e4acd5fc8b4b
SHA512 cdc4936f557c5d8cd7f8660b842ffd36127ef72ffb111648579b3a4f588d585a41c31a839975731e9ba80615fe2f865c11e3ee19a6746119181d4ba3dab26c78
SSDEEP 6:h1A+1E3+e9XplskmlGlUjfxIl8WI10cAe:jB1E3+e9Xwk9loOl8v0
TLSH
T1D3538C04EA604032C5008333A0D50703F325F4160E1A9F0E1017A2B80C032D6286448C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 6da3eea9b6ea6b75bc28c33e3b2517e90e0daea152d36eb68ad9877e4c98b684
MD5 8485d2ae233e15e0b1dbea6096dc5998
SHA1 a4806fd5e977edcdda78b4c7fb9d091fd345f912
SHA512 6cfdee01c5e44e23f106af78e8ed0923fdfceea6aeb46c7325c19494508d4efd8cfd866369b05934f6abcdbad8bddcb325fa7662b2eda2ab6c674c738079dc90
SSDEEP 768:+0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbat:QZP2tFP3vqY8lqEMzTaBacg
TLSH
T163258437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D98D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 610949934c1055dde85c4e919fdfcf4ba7ce4b5f65b0f253b1b2e7dfdaede70b
MD5 7da6334aec8ea601d7234573475fa789
SHA1 0d3364cd354d4d0067d9a909a6da7ce87f7d0415
SHA512 2dad35c471f595f93f33b778aaf4fabd5196676994367f2f6a854da64a572e43ef540e8f0176c0e73256dc1ebf9ab93dbf598c9de995119c2bf70c2c1e4ae413
SSDEEP 96:lX7Igxlt9NXteUMUst87XtVUMbstyUMlstnOXt0L2tFLXtvt2AtWt:lX8g6nanHny
TLSH
T1F463C76463E86649F3FB2E706AF665172E3A38E15E39D74C1250424D0DB0F19DB30B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
MD5 5433eab10c6b5c6d55b7cbd302426a39
SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
TLSH
T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 5fe7d692fa499a02f3461860af0da3a2cb0ada6b3c71fd9d0d3545c7b8101a57
MD5 254b21f016a84dfd32215728ea27451f
SHA1 c5e8122798dc57d7096ddbc46a12b1514bf4c05d
SHA512 2855bf28c57d467437feb9820969bc4d06e48bbda5fd7d60e1767bd62eb61f90bf6e49b96533beb0a0f1c184a7c170117b70a6e8f73bd7408550448e3d9b8abd
TLSH
T1F9216B671B8ED87089E01BA72CED8E257377D7CA93A1D065B349A039880312D5B3D45D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 8bb33c3e37cf19aefc3294a15197162f1f525245a0522de960cf9340fdddc609
MD5 7e9b78c54b0279a082e39559f7466e47
SHA1 e9728a1faf49ac3fc8446fee0a3ff8c73ceaf739
SHA512 08c1bebc89c4bdaf5effda72d14fc33c345ac422d508b126eb7a0b5fdc52ee6c87b63039f01f7133a7e044bc293ac8a30e3dc1d9e70e4218e268c1df0b39695c
TLSH
T11D31321063E0069AF0E30933FC7FB30A9FB1FC119B169A4E018C91480DA1604A57FB6A
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 2982135a5d211e71cd36aeb28f990a785b7963cd5120226c3fb1bb73b30f6d4b
MD5 b1dda72ad9d40b5ab53330ebc4adf527
SHA1 5cc435828b0931fc76d97fef38bd0e3a3e49e6c1
SHA512 ffd887b49c6a9a3e79e586ce3b6b0c55e1662355c8774ccf9435f5a9c1b4e3371a9e57f304a03e386e1bb33a7c5a114875b5a93b674fd95f631d48188bd96520
TLSH
T17271331067E01196F1E30D33FCBFB7099FB2FC019B169A4E014D915A1DA1604A57F76A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2460-31-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/2460-34-0x0000000005280000-0x0000000005290000-memory.dmp

Download

memory/2460-36-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/2460-37-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/2460-38-0x0000000005280000-0x0000000005290000-memory.dmp

Download

memory/2460-35-0x0000000005280000-0x0000000005290000-memory.dmp

Download

memory/2460-32-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/2460-33-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/2460-29-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/2460-28-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

memory/2460-30-0x00000000044C0000-0x00000000044D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads