Overview
overview
6Static
static
1cvs888xgst...pd.zip
windows10-2004-x64
1cvs888xgst...pd.zip
windows11-ltsc_2024-x64
1art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...D.json
windows10-2004-x64
3art/sound/...D.json
windows11-ltsc_2024-x64
3art/sound/...38.wav
windows10-2004-x64
6art/sound/...38.wav
windows11-ltsc_2024-x64
1art/sound/...3o.wav
windows10-2004-x64
6art/sound/...3o.wav
windows11-ltsc_2024-x64
1art/sound/...95.wav
windows10-2004-x64
6art/sound/...95.wav
windows11-ltsc_2024-x64
1art/sound/...93.wav
windows10-2004-x64
6art/sound/...93.wav
windows11-ltsc_2024-x64
1art/sound/...2o.wav
windows10-2004-x64
6art/sound/...2o.wav
windows11-ltsc_2024-x64
1art/sound/...85.wav
windows10-2004-x64
6art/sound/...85.wav
windows11-ltsc_2024-x64
1art/sound/...5o.wav
windows10-2004-x64
6art/sound/...5o.wav
windows11-ltsc_2024-x64
1art/sound/...8o.wav
windows10-2004-x64
6art/sound/...8o.wav
windows11-ltsc_2024-x64
1art/sound/...94.wav
windows10-2004-x64
6art/sound/...94.wav
windows11-ltsc_2024-x64
1art/sound/...7o.wav
windows10-2004-x64
6art/sound/...7o.wav
windows11-ltsc_2024-x64
1art/sound/...9o.wav
windows10-2004-x64
6art/sound/...9o.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
cvs888xgstreak_s13 upd.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
cvs888xgstreak_s13 upd.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
art/sound/blends/H22A4_ENG.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
art/sound/blends/H22A4_ENG.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
art/sound/blends/H22A4_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
art/sound/blends/H22A4_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
art/sound/blends/HR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
art/sound/blends/HR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
art/sound/blends/SR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
art/sound/blends/SR20DET_SPORT_EXH.sfxBlend2D.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
art/sound/engine/H22A4_ENG/1538.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
art/sound/engine/H22A4_ENG/1538.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
art/sound/engine/H22A4_ENG/1933o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
art/sound/engine/H22A4_ENG/1933o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
art/sound/engine/H22A4_ENG/1995.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
art/sound/engine/H22A4_ENG/1995.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
art/sound/engine/H22A4_ENG/2693.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
art/sound/engine/H22A4_ENG/2693.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
art/sound/engine/H22A4_ENG/2802o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
art/sound/engine/H22A4_ENG/2802o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
art/sound/engine/H22A4_ENG/3485.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
art/sound/engine/H22A4_ENG/3485.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
art/sound/engine/H22A4_ENG/3515o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
art/sound/engine/H22A4_ENG/3515o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
art/sound/engine/H22A4_ENG/4218o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
art/sound/engine/H22A4_ENG/4218o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
art/sound/engine/H22A4_ENG/4394.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
art/sound/engine/H22A4_ENG/4394.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
art/sound/engine/H22A4_ENG/4877o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
art/sound/engine/H22A4_ENG/4877o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
art/sound/engine/H22A4_ENG/5449o.wav
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
art/sound/engine/H22A4_ENG/5449o.wav
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target art/sound/engine/H22A4_ENG/5449o.wav
- Size 429KB
- Sample261107-252fssf15t
- SHA256 239aa7548f9ff73ab08c744016bbd0e57705e7c3e3d9979a32214fa1a1094f96
- MD5 1a60fe0a8fa56742a60f0a3813d234ea
- SHA1 0ef4258bc8fc18b3e15589ee56ae0484744e9910
- SHA512 2dd8618a5c16d314bb7aa247022668a8841e8d6265250219d9ecd2a1d01ae39dc716daeb4af88fb896fd5643ec193db7cb45fe2d6b56b96dc99563f50555b7fd
- SSDEEP 12288:aJARLftkkUFk9XVsYdwm+DD0InP81nIemti:9FftXUFuXKYdCoxgi
- TLSH T1129412BF8DA1751B005A3EE01F2BF0B536EDC9EE6A1651128F4ECCF1705A51E089B672
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{BFFA890E-9F87-478B-8A1F-BE8432DC0A7C} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3308 wmplayer.exe Token: SeCreatePagefilePrivilege 3308 wmplayer.exe Token: SeShutdownPrivilege 2008 unregmp2.exe Token: SeCreatePagefilePrivilege 2008 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3308 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3308 wrote to memory of 1228 3308 wmplayer.exe 90 PID 1228 wrote to memory of 2008 1228 unregmp2.exe 91
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\H22A4_ENG\5449o.wav"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:4520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
- MD5 987a07b978cfe12e4ce45e513ef86619
- SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
- SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
- SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
- TLSH T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 42263fd697b3703e2ef2d4aea7f448cd26e1a1df5a16f9b101211d350d80b474
- MD5 82160b8bb57082c43484296b219cf6db
- SHA1 2c82326e17e8bbbfdaf3c3665c7ad94384e6bd68
- SHA512 7306c99b3aba04d8cc8f8e05ce3988729e43347f1a9e80afc9d7190343c2cf5b3212a73441ade526dc22b4b6a08efa76083aa4b86223747df21611293feeeeeb
- SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaS:rZP2tFP3vqY8uqEMkTaBacg
- TLSH T1A5258437D190B0C5CE2C7071E9ED8F09BA23A10B11A052465FF8A57E7A633D99D1B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 142fdf2c2149fcf1c14f2b61da348a8a9ed6f23b511b2d925e64a4767a0da5ff
- MD5 5da1f724dbc09eecace903cd8d01c3bf
- SHA1 d4d05b572af118ac93a7c76acbdba5a48f9cf035
- SHA512 ff12a9d62e7e481ff78350cacfeece7014eb3cc0b29cbbf4030fcd2eaebb1f164cae603d904ef0dd4d766e118b9ba203c28cec10d19b7dbfba12600d25e61e65
- SSDEEP 96:rpnEyAfltDNXtgUMUste7XtrUMbst8UMlstJOXtqL2tLLXthtEAtYta:r2y7nqnpnya
- TLSH T15F63041427E44A5AF7F72E7769FA551A3E3A38E06E36C14E0650425E2871F6CED30F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 230633d6058938acfff6ecf72e840d44683cc7f14054072f44319cd927a6528c
- MD5 30186d982082f7accf2df47b5a8dc8f2
- SHA1 a2eb35f6466881d334f60552939e5597c762a42b
- SHA512 96aefcfd187b82f31a707730c73ece25171448ce9772c3689500e5a5f1a50b2d66b039eb6f673cc7b6ff314d79d9173a9ae657341d43830e598b3b41cd0a1884
- TLSH T1D3216E571B8DD4708AE01BA71DEC8E25737BD7CA83A1D0A5738DA4398C0352D9B3D15D
- MD5 SHA1 SHA512 TLSH