3b54fc30a02f98a4451ee8193b52e899d76a78659f8197230d0c99fac3cd9684

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BuLLeT-External-v3.zip
Size 6.3MB
Sample261027-lt9d9sdb83
SHA256 3b54fc30a02f98a4451ee8193b52e899d76a78659f8197230d0c99fac3cd9684
MD5 3be70dab8fd8d72bc4ddc89acc2fa3a2
SHA1 4bc73de8d1e39fe105b3c1bf7273ebff060c0af3
SHA512 45fb1420aff43571fbed3ea6d76f9a34688149cf275711909f3ad492b400814d2d18dd91f3224f76fe4f2128a69591c2acae1ab4dd176c7907e885162ef1297a
SSDEEP 98304:rFTcrBmVpH+ET80x3XkrDBgIOCxjZuLMsxko4gbcKhPKZ8AYqFVv1W8GUkfKxXE:Rqy+sVeCcZuPkJK5hAYqF5HjkaXE
TLSH
T178663338F520760CE91A904B45CBC7E23ECBA0316A255BBC0575C760BFD6DA70B1A9F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	3372	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3372	wmplayer.exe
Token: SeCreatePagefilePrivilege	3372	wmplayer.exe
Token: SeShutdownPrivilege	2132	unregmp2.exe
Token: SeCreatePagefilePrivilege	2132	unregmp2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3372	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4996	3372	wmplayer.exe	95
PID 4996 wrote to memory of 2132	4996	unregmp2.exe	96

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\BuLLeT-External-v3.zip
1⤵
PID:2952

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\DisconnectHide.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:2116

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 2824
  2⤵
  - Program crash
  PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3372 -ip 3372
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 ef69a0586f1a7ec100ca3851677dc415f0e946fa38632634f6f26733f824ffd4
MD5 ba0f3639c774f68af816f4027ae361f5
SHA1 f50e10123ec495df56e6affae3d30da5286ddaad
SHA512 77b215068ad0c9b51a96c237bb186b0e1c070fdaa687836e045e80ddb1f8b80d1a24ffcb43b032ca0ab4c4dc9b127287e444bcc9fec1458c1000c86836b53dd3
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaS:rZP2tFP3vqY8GqEMMTaBacg7
TLSH
T1C2258537D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 c05f68d745772493d1c812f01cca1029c7b555ec708e7ef4024e48c21d4116f5
MD5 3b403c41183a5682d7784c4e5312f8fe
SHA1 a02b996f0931b74e328a53b7a0fbd0b5470b821c
SHA512 d6dc0666e8eda868f03d8256ab40209df49595a65ab10e585ac9b20a65578f9649269bad31c2e0de198502696061809e2d7b989f70ffe4431e5258ef0e13fa99
TLSH
T194210A570A8A98B189A103F31DDC8A256377C7CE8750E166B28DA03E4C0616D6B3E16D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 21c1ffd6a3e0b4a01ad9ea0082074cd63ca8c52bbf8f20f87fc38ce9a13b098a
MD5 c075aff182a545c8bd8b53b97529e681
SHA1 68c8a4a32bd998a4fc5920e6b2bcc2d142241d80
SHA512 2914e9279d495822d12ffdaf27802aa5e3560b8a181297dd8069e0efcf8308c816b8f419bfed44122eb9a266737501da4704d7b127002ce7583afe60d8c4b499
TLSH
T15B31020023D5159AF8A34532FD2BA702AB71FC06DB1ACA4E418C42590DA6104BA7BF7F
MD5 SHA1 SHA512 TLSH

Submit Download

U2QWX0J0INWBBPJA7T1O.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U2QWX0J0INWBBPJA7T1O.temp
Size 3KB
SHA256 8a8b43f87808b0d96087ae25eae5b9ac2217d45af597047d55b2e488814d6bef
MD5 9b3232375d628c72f4b1600b5c905830
SHA1 3dc3126f2f9d87be9c73f903e0b2e210250be46c
SHA512 20c44ccbfd3a6bcded32b4c48393c2f5746bab63e590352a052fe98e336e09b7b0c44aad09e216470d4c8440229168b006f876d389663ae8c48a1b18a37ce3de
TLSH
T1AD71220023D6159AF8A34932ED7BA701EB35BC07DB1ACA4E418D425A0CA6100B97BB2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3372-28-0x0000000008390000-0x00000000083A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads