Overview
overview
6Static
static
1cvs888xgst...pd.zip
windows10-2004-x64
1cvs888xgst...pd.zip
windows11-ltsc_2024-x64
1art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...38.wav
windows10-2004-x64
6art/sound/...38.wav
windows11-ltsc_2024-x64
1art/sound/...3o.wav
windows10-2004-x64
6art/sound/...3o.wav
windows11-ltsc_2024-x64
1art/sound/...95.wav
windows10-2004-x64
6art/sound/...95.wav
windows11-ltsc_2024-x64
1art/sound/...93.wav
windows10-2004-x64
6art/sound/...93.wav
windows11-ltsc_2024-x64
1art/sound/...2o.wav
windows10-2004-x64
6art/sound/...2o.wav
windows11-ltsc_2024-x64
1art/sound/...85.wav
windows10-2004-x64
6art/sound/...85.wav
windows11-ltsc_2024-x64
1art/sound/...5o.wav
windows10-2004-x64
6art/sound/...5o.wav
windows11-ltsc_2024-x64
1art/sound/...8o.wav
windows10-2004-x64
6art/sound/...8o.wav
windows11-ltsc_2024-x64
1art/sound/...94.wav
windows10-2004-x64
6art/sound/...94.wav
windows11-ltsc_2024-x64
1art/sound/...7o.wav
windows10-2004-x64
6art/sound/...7o.wav
windows11-ltsc_2024-x64
1art/sound/...9o.wav
windows10-2004-x64
6art/sound/...9o.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
cvs888xgstreak_s13 upd.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
cvs888xgstreak_s13 upd.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
art/sound/blends/H22A4_ENG.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
art/sound/blends/H22A4_ENG.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
art/sound/blends/H22A4_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
art/sound/blends/H22A4_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
art/sound/blends/HR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
art/sound/blends/HR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
art/sound/blends/SR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
art/sound/blends/SR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
art/sound/engine/H22A4_ENG/1538.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
art/sound/engine/H22A4_ENG/1538.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
art/sound/engine/H22A4_ENG/1933o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
art/sound/engine/H22A4_ENG/1933o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
art/sound/engine/H22A4_ENG/1995.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
art/sound/engine/H22A4_ENG/1995.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
art/sound/engine/H22A4_ENG/2693.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
art/sound/engine/H22A4_ENG/2693.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
art/sound/engine/H22A4_ENG/2802o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
art/sound/engine/H22A4_ENG/2802o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
art/sound/engine/H22A4_ENG/3485.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
art/sound/engine/H22A4_ENG/3485.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
art/sound/engine/H22A4_ENG/3515o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
art/sound/engine/H22A4_ENG/3515o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
art/sound/engine/H22A4_ENG/4218o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
art/sound/engine/H22A4_ENG/4218o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
art/sound/engine/H22A4_ENG/4394.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
art/sound/engine/H22A4_ENG/4394.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
art/sound/engine/H22A4_ENG/4877o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
art/sound/engine/H22A4_ENG/4877o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
art/sound/engine/H22A4_ENG/5449o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
art/sound/engine/H22A4_ENG/5449o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target art/sound/engine/H22A4_ENG/2693.wav
- Size 133KB
- Sample261107-252fssf15t
- SHA256 750c4b9881d10789df60e66c0cafe3492a39cf83dd688256b4fca0747d5cedde
- MD5 da78666934af6791cedee2756f0de4c4
- SHA1 8f7d995189d8828d8991cb82d4eaf4d2060c9f65
- SHA512 aba2e43ba11a634d317c474a3aa93a29da0380f78305b4dd528e4a59eaad392b4cf089a23d764523678ee4b5692e3519394d50f705dcbbd387d239f07246176f
- SSDEEP 3072:13lPHk60dA0/NPik+RttW7YZ16ecGcxu1MEbJL7ue:13lH5KBNPr+RiK6ecGc81MEge
- TLSH T1CCD3CF2D98E22B12C57F60695DD7C4694177D80C2A26C91EFE1B4BE2324B22217DFB7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{D4561B8D-9C21-4D64-838C-8327F2127E2C} wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3876 wmplayer.exe Token: SeCreatePagefilePrivilege 3876 wmplayer.exe Token: SeShutdownPrivilege 2608 unregmp2.exe Token: SeCreatePagefilePrivilege 2608 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3876 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3876 wrote to memory of 2224 3876 wmplayer.exe 92 PID 2224 wrote to memory of 2608 2224 unregmp2.exe 93
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\H22A4_ENG\2693.wav"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:2620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 256KB
- SHA256 7d51348a60994b08a1b8d9a591804d3e17be88cd62518dc183d37d1cc8d3d3f8
- MD5 0be6b82035574f3a7362b706df6024b1
- SHA1 5193e99057168ae42225b7d8504fa93a3171a54b
- SHA512 e15c84d30a97e8d480799dc05fb5152fecd2f37abc2549480f97bc171390ba0ceb9d34e1924245e9d581b26305d941883db2ec7ff7a37b48f04b806270f78af2
- SSDEEP 768:Of0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:O69
- TLSH T1B6440137E5A0B084DF2CB571E2AC1F48BA73350B01E416465FF4A57DBA633D6890B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 cd90f8314e8b3a18329149f248161cc1d792a7e67dc9f889c732ddb26af9aa1a
- MD5 a03ef0d746d8ed0957300669e7e2db1f
- SHA1 e8ec79ee4f8f554265f39646629bb2b459ee4c70
- SHA512 36d1c5bbbda854d408cd9c224a45a294f35af587c8fdcfaad1ae78bc35a308be375e96472c82140faeb16b3a042ae61c6b1418c0531b05d17a0c26dda92603eb
- SSDEEP 768:Z0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbav:PZP2tFP3vqY8CqEMWTaBacg
- TLSH T184257437D190B0C5CE2C7171E9ED8F09BA33A10B11A052465FF8A57A7A633D99D0B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 a6e41bfe13f7d80fd815ac7eae540d8de49390acdb8ad8b6e873a9e4d9b9643b
- MD5 d9c8a80950ff8322f8fe5e0da3dc05d1
- SHA1 b0dbff99d18b938aa83dcb6145e0d801879838d6
- SHA512 da2b4dfd5027a11356acfef60963b744796ad742b7cbce31b686fcf6cd43b48b3602ececbb40ee5befb2ee6e9b0d0a0e28fc057feede4fc08d9dff7ba70c68c2
- SSDEEP 96:iU0RfUlt4NXtZUMUstp7XtKUMbsttUMlst+OXtDL2tALXtQtHAtJt:iUOnnSnIn6
- TLSH T1DF63C16257E45648F3F72F706EF666173E3A38A56E35D14C0224426D0A72F28EA30B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 532522a8705a48a20fdc22ded19b3cf4dfee2a0c6c97af681b2c7db3c40993ab
- MD5 c5935d80cdec066d4f547f2e8fe7a93e
- SHA1 294c4dc4c9c25fb6a4896c4c4b631b108858d49e
- SHA512 49ff75415973bc72337f5d3b8786a1353edbb643a611bcf0e5b2ff9214798a3492a212de6d670c19e1da9ebcc8f1991e98c0c5820efc597325566289bf6909a1
- TLSH T1FC216B571B8DE4708AE01BA71CEC8E25737BD7CA83A0D0A9B38DA0394C0352D9B3D06D
- MD5 SHA1 SHA512 TLSH