5d96db85931e75d366bc30390c1db7d8bf2830c9de15173c05a8e3c2d62135b4

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
screen_recording_20261023184116_0 (1).anydesk
Size 27.7MB
Sample261023-tg3pystt2n
SHA256 5d96db85931e75d366bc30390c1db7d8bf2830c9de15173c05a8e3c2d62135b4
MD5 5ea8bf93ab089f47ebad3be7d22aa368
SHA1 ecf4c89102530ea129e7398358603e72ebd79995
SHA512 27ec05b54b96e2244e8b2fb600ee584b76e1de0dc31d95434870c63ac3855ee70b9cba727448062d1e577af8a207a21a2e2b20cb7feeb8b4629125f2807777ab
SSDEEP 786432:WzDdxpIJGXy4nilbfgIToMxTM/IZIDB0tlbuhR3:WzZxpIcXyiilbDToMxTM/sID0uL
TLSH
T10357F1E989829925C731143A6427E3606ECC95BC67DC4619C3FCAD349DA061EFC4BB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3280	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5744	4268	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4276	unregmp2.exe
Token: SeCreatePagefilePrivilege	4276	unregmp2.exe
Token: SeShutdownPrivilege	4268	wmplayer.exe
Token: SeCreatePagefilePrivilege	4268	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4268	wmplayer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5080	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4268	5080	OpenWith.exe	91
PID 4268 wrote to memory of 1344	4268	wmplayer.exe	92
PID 1344 wrote to memory of 4276	1344	unregmp2.exe	93

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\screen_recording_20261023184116_0 (1).anydesk"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3280

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Local\Temp\screen_recording_20261023184116_0 (1).anydesk"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 1200
    3⤵
    - Program crash
    PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4268 -ip 4268
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 3a34817428957bff7a7c522c7e28a3832128112c4fd01cfbbc85475dfce3f145
MD5 4494081954ffdd3d138b62a740e81d29
SHA1 9e148ccd8cabd510012dd5442c3c1780c69d306e
SHA512 c174253d19041f87db0e8c9ea0603234e20db8e8923dcd2d7795a97ea6bc77921b36c364f5fd506ae61eab6424b16215e5a7e2e22623a8464ee79d311c49e7ed
SSDEEP 768:bf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX0AooJID:bNpZZQeoVYocxYCutFCJGAKt
TLSH
T18FC430379560A098DF3C31B1E2EC6F4CBD72641A12E006421F74B67F7A237D99A0B5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 2e221b5f03adc6235fbc99c6271b50a996f3cd937eaa12fdde245a341367a79f
MD5 3222909b1d694c1550dcd2e64b90a0c8
SHA1 3d73de2a2e9d3a03e61d40cd9aaea7103ec6f50f
SHA512 b987f405b946901bb654097951a52973e5fb37aac56c3066c608ab58255114c77d140ba4fabce1debb2dd4e7325854af7e6f0d3b7e4095327f884b60f987ca61
SSDEEP 768:x0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbat:XZP2tFP3vqY8LqEMPTaBacgg
TLSH
T111258437D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8957E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 077324c7df9a5cfd41a51400270d13df9cf2798cd490b7519c66ed5ef7f9bd67
MD5 024034cbf9295fe2aea72a1d75b33bce
SHA1 9a6b5dd5c83beaedd0c1a04f7ed06a9b4640ff9a
SHA512 402cafb500add72c9cd9d4a3413b7f44b16437d473eaa4ef08de8ac1ec910d926ba6b2e121ecb650d15be94b5c62b06a23f3a1b3425c499820b118c8621bdac5
TLSH
T1962157574B09E4B1CDA297B368CC8A27B3B6A7DB5754D025B3CAE01A880113E533D17E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4268-33-0x0000000008750000-0x0000000008760000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads