Overview
overview
6Static
static
1cvs888xgst...pd.zip
windows10-2004-x64
1cvs888xgst...pd.zip
windows11-ltsc_2024-x64
1art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...38.wav
windows10-2004-x64
6art/sound/...38.wav
windows11-ltsc_2024-x64
1art/sound/...3o.wav
windows10-2004-x64
6art/sound/...3o.wav
windows11-ltsc_2024-x64
1art/sound/...95.wav
windows10-2004-x64
6art/sound/...95.wav
windows11-ltsc_2024-x64
1art/sound/...93.wav
windows10-2004-x64
6art/sound/...93.wav
windows11-ltsc_2024-x64
1art/sound/...2o.wav
windows10-2004-x64
6art/sound/...2o.wav
windows11-ltsc_2024-x64
1art/sound/...85.wav
windows10-2004-x64
6art/sound/...85.wav
windows11-ltsc_2024-x64
1art/sound/...5o.wav
windows10-2004-x64
6art/sound/...5o.wav
windows11-ltsc_2024-x64
1art/sound/...8o.wav
windows10-2004-x64
6art/sound/...8o.wav
windows11-ltsc_2024-x64
1art/sound/...94.wav
windows10-2004-x64
6art/sound/...94.wav
windows11-ltsc_2024-x64
1art/sound/...7o.wav
windows10-2004-x64
6art/sound/...7o.wav
windows11-ltsc_2024-x64
1art/sound/...9o.wav
windows10-2004-x64
6art/sound/...9o.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
cvs888xgstreak_s13 upd.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
cvs888xgstreak_s13 upd.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
art/sound/blends/H22A4_ENG.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
art/sound/blends/H22A4_ENG.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
art/sound/blends/H22A4_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
art/sound/blends/H22A4_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
art/sound/blends/HR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
art/sound/blends/HR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
art/sound/blends/SR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
art/sound/blends/SR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
art/sound/engine/H22A4_ENG/1538.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
art/sound/engine/H22A4_ENG/1538.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
art/sound/engine/H22A4_ENG/1933o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
art/sound/engine/H22A4_ENG/1933o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
art/sound/engine/H22A4_ENG/1995.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
art/sound/engine/H22A4_ENG/1995.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
art/sound/engine/H22A4_ENG/2693.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
art/sound/engine/H22A4_ENG/2693.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
art/sound/engine/H22A4_ENG/2802o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
art/sound/engine/H22A4_ENG/2802o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
art/sound/engine/H22A4_ENG/3485.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
art/sound/engine/H22A4_ENG/3485.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
art/sound/engine/H22A4_ENG/3515o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
art/sound/engine/H22A4_ENG/3515o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
art/sound/engine/H22A4_ENG/4218o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
art/sound/engine/H22A4_ENG/4218o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
art/sound/engine/H22A4_ENG/4394.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
art/sound/engine/H22A4_ENG/4394.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
art/sound/engine/H22A4_ENG/4877o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
art/sound/engine/H22A4_ENG/4877o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
art/sound/engine/H22A4_ENG/5449o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
art/sound/engine/H22A4_ENG/5449o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target art/sound/engine/H22A4_ENG/1933o.wav
- Size 558KB
- Sample261107-252fssf15t
- SHA256 062a1977feb3e3c88d83e8b0eb6e9673d7322504b73c5c17ae3c2427a1107563
- MD5 985a68be78d04b7ab53ffa21d2b68ad9
- SHA1 5db85e86bd19ffe300bd9b5212d031935521439c
- SHA512 4679a55c46e05be1b7689e8b9a7376fee2ce2995c46afce047623901abc24954f88d8b7be9cec6807c86a6c3640a0aafa2ad50284bd9d171acefec89e4687c87
- SSDEEP 12288:zGOgKoeagSjgA+iXd+kaTnTEb/wimr+JkqyDNze:Uhv+iXHsnopc+iqy5e
- TLSH T16CC412BFC8B5288388AF7DE07D6BB4BED9895ADE282C004267074FD1B527B49458FD05
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{0F69B111-70FB-413E-8415-F5ED3A1D5B3D} wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 388 wmplayer.exe Token: SeCreatePagefilePrivilege 388 wmplayer.exe Token: SeShutdownPrivilege 2412 unregmp2.exe Token: SeCreatePagefilePrivilege 2412 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 388 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 388 wrote to memory of 2352 388 wmplayer.exe 88 PID 2352 wrote to memory of 2412 2352 unregmp2.exe 89
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\H22A4_ENG\1933o.wav"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:4260
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 768KB
- SHA256 f0ea48321969fa420cc9ce4441f8203e33e79393567aa08fc657cdef1981b596
- MD5 bcf9a7522783a15b49faced5c9cfbe8a
- SHA1 00d3eb9a3f2103cff415547799bc3959b70feb52
- SHA512 cf97a512bb1ef701bc2ad2be63603d539c9a1272d69345b8b0a8d1b351b6c34e69c25ca7adff6a4364c5f99f2084d5565de65e670f0eb1f0d11b5bf9b2e9a2a0
- SSDEEP 1536:569tQeoVYoUxYCutFCJGAKt2/oGXr1Yl+:5CtUZy/
- TLSH T1A1F40B3BA474A098DF3C36B1E1AD6F8DBD72241A12E006411F64B57F7A337D8CA4A4E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 cc7bed43da1b06210856a7c6a9fb47d34881fc51d12fe1c8f539512b6c12a19b
- MD5 9827bbcaec9c9f6bd2407cb993771de8
- SHA1 503617c5aebe391dfe8d43b02486a8dc4529b683
- SHA512 8b8a605fb21af7703a3f4ca3c4203946ab571e3318cc7a4142512d912c81d2508017573f04f74543a619c40199d7057126056ccef5c9cf5e2a622c9e67f0622a
- SSDEEP 768:l0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbah:jZP2tFP3vqY8EqEMtTaBacg
- TLSH T163257437D190B0C5CE2C7171E9ED8F09BA23A10B12A052465FF8A57E7A533D99D0B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 bbf07a9d9fade0b2be36604083ce2d383bc3bcc1f8de3d2d800e0719840998a9
- MD5 74e4bf52b46739fbf838ac54e92f9c9b
- SHA1 078261b0907054d9620dc683adef63f57dadc0c8
- SHA512 618b547e8a4c713fa2584ba817662e280622e266d6101fe078385e6ca71ff936a475f2d832cd01affae79a255e0d3201e058df9df423a8eacb768e6890d347ea
- SSDEEP 96:Mmlkv9sltrNXt4UMUst27XtjUMbstkUMlstBOXtyL2tTLXtZtMAtgt:MZvRnKnxnC
- TLSH T1DE63B31126E95659F3FB2E717EF6651B1F3A78E16E39D20C1318628D0D60F28DE30B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 3ded31fc1b8507cbe2fbd4a68c3f8276f48b4a5b6db9ba1265e0ae37d41e1cae
- MD5 8ace03dc8dc65d88f4fbdb77f65eaf0c
- SHA1 86fe0d15501b780ee5c33e60181f9a42b294a8a5
- SHA512 b40889da5730d7ca12669c3c36fb69abc2882250fe64ed5dc9b18b838795fd63695ab12e3c87f6d6222038c5d3a13bdb2be2a023ec6f0f2f0e2a92d64b1f9079
- TLSH T193216B571B8ED47089E01BA71CEC8E2573BBD7CA87A0D0A9B34DA0398C0352D9B3D16D
- MD5 SHA1 SHA512 TLSH