1d44875c18f462f7faf7fca365ad9aa3f24c6ce75c12d25eac6e05d41a9b4983

Analysis

user interaction
yes
max time kernel
20s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ssstwitter.com_1791823314433.mp4
Size 44.8MB
Sample261012-t7264syscx
SHA256 1d44875c18f462f7faf7fca365ad9aa3f24c6ce75c12d25eac6e05d41a9b4983
MD5 1334a920071ed7514b40fb0ada31de39
SHA1 f844428e32e6679d2c3e8a72e9653bc580ac07de
SHA512 f372d578aac7355f435d9ada8ed2711086481d781d4f0a4544d6d433115cf177106b09c8c637dc6c67943cc20b6eee77beda2154ef818853a4e144bd266b5cc3
SSDEEP 786432:Sxymk68mJQKvB4unss4zUa9WikpXLNBP8nT2NmYtMhiwoLXG21vetI4aLUz/ohKl:SEmnrJ3vBhss6UliYXzknLHhiwyXV1v4
TLSH
T15FA7335137C16D67CC3C033644F90B68B2A2EA6F2B138BD7D597AE242D913E58D7A2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4616	2260	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{D39A005E-952B-4461-9953-EF2B08EE9B61}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2260	wmplayer.exe
Token: SeCreatePagefilePrivilege	2260	wmplayer.exe
Token: SeShutdownPrivilege	456	unregmp2.exe
Token: SeCreatePagefilePrivilege	456	unregmp2.exe
Token: SeShutdownPrivilege	2260	wmplayer.exe
Token: SeCreatePagefilePrivilege	2260	wmplayer.exe
Token: SeShutdownPrivilege	2260	wmplayer.exe
Token: SeCreatePagefilePrivilege	2260	wmplayer.exe
Token: SeShutdownPrivilege	2260	wmplayer.exe
Token: SeCreatePagefilePrivilege	2260	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3904	2260	wmplayer.exe	87
PID 3904 wrote to memory of 456	3904	unregmp2.exe	88

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\ssstwitter.com_1791823314433.mp4"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 2196
  2⤵
  - Program crash
  PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2260 -ip 2260
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 265e6067f7ecde7cc1b4251dafa6e0e1acf2a6a9066265f7f3d18c8e75591b9b
MD5 45611d6c04a5b2ff3233adc71812ba51
SHA1 be74155d3a0cfb1bea5cbf8eb2be7771b0b1959d
SHA512 bee89a2bef099b00730137d0501449797017234a4835354d2eba54ca3a05ee3edef0c4bb95c5e6bc9396fa0e8dab101940d5311f3ff9adc43130ffe750287751
SSDEEP 6:3+1E3+e9XplskUrbnj5lbZnbPVf7b0I10cAe:O1E3+e9XwkUHj5JZbP9Xh0
TLSH
T141531230E311C025F6008232A0A507C2A3FCBF581A099F0AE2173C3C0CD12C6E9E8087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 a70b729f51deb8e4ac88a05f4b41a69b84ba70ac4b27eab52a35af1dd71d097a
MD5 e1675b8ebb3c8f36a924294bfc6a08f6
SHA1 830064792f93e8d9515717edfc95eba2294da558
SHA512 6720ead9dfef377f76aaeeeeecfbd135a391d1140439363d9e1a07ca4cc0b8863519a12730e5daaf8dc7f6f137df93f8045af45e257da58eb12f38f0495c724e
SSDEEP 768:t0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaK:bZP2tFP3vqY8PqEM4TaBacg
TLSH
T19B257437D190B0C5CE2C7071E9ED8F09BA63A10B11A052465FF8A57E7A633D98D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 d20730d4914556ce77975910736c5cd736aceab23a383f83998c15b6f0f8ec24
MD5 7ca40ec9c69b0653185f02c12d4f938a
SHA1 1354b573afb330bf183f380d2217cd2c820d816f
SHA512 4ac6492aa42fbf9b2bbf79f73e8c705e831d6c5cc9ecd6608687fbd38c2ba9cb4af5ef0522a1af2e9238243ec41362d0ba6001f9a7a8148e09ac523fb3fdcea8
TLSH
T1C0217D571B8DD4718AE01BE72CEC8E257377C7CA83A1D0A5B34DA039480352D6B3D15D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 7f1ba6b670cbf7f8ab2918ad5a66cc9029174b2f57064720041374d8996e1cea
MD5 6a9a0063886cede609c66ee0e4af71fc
SHA1 50c2b5adb826ee36db2f21245e2943ee3ea232ce
SHA512 72ea75063f763390e9953bba2361c419adc441518a84251d71408adb3e91b42d988768b01f85f5976cee12881ec7502bdae2d14683327239c21fc785809edcd6
TLSH
T19C31EF1067D15249F0A34A33FC3BB701AB65FC029B1A9ACF018EA2890DA5504A77B76A
MD5 SHA1 SHA512 TLSH

Submit Download

7USVAQ4V9EFQPTEPNUOB.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7USVAQ4V9EFQPTEPNUOB.temp
Size 3KB
SHA256 dbe5be8c1ff9687bc5e0045e28dbcc0e179eb7501eb88038a2b945df30d1b9e0
MD5 cd6aaa813103cfb63261cae4f2fd4524
SHA1 31064aea70a002e4160578a3c28b0211c2cc9fd3
SHA512 96cc33e2fb82dc936b64fc35eb9b21df94ba3718b818fb79dab75793a0c3d6168a31d3e0a9d70333da1f45f745bbc62ce177769ac2e6dd134782385ad983c728
TLSH
T16171F20067D1A249F0E24A33FC7B7701EF69BC02AB16DACF018A618609B5500A77B72F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2260-35-0x0000000007200000-0x0000000007210000-memory.dmp

Download

memory/2260-36-0x0000000007200000-0x0000000007210000-memory.dmp

Download

memory/2260-32-0x0000000007200000-0x0000000007210000-memory.dmp

Download

memory/2260-37-0x00000000074B0000-0x00000000074C0000-memory.dmp

Download

memory/2260-41-0x00000000074B0000-0x00000000074C0000-memory.dmp

Download

memory/2260-40-0x0000000007200000-0x0000000007210000-memory.dmp

Download

memory/2260-39-0x0000000007200000-0x0000000007210000-memory.dmp

Download

memory/2260-38-0x00000000074B0000-0x00000000074C0000-memory.dmp

Download

memory/2260-31-0x0000000007200000-0x0000000007210000-memory.dmp

Download

memory/2260-33-0x0000000007200000-0x0000000007210000-memory.dmp

Download

memory/2260-34-0x0000000007200000-0x0000000007210000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads