Identifier / Programs / Windows

unregmp2.exe

Microsoft Windows Media Player Setup Utility file version info (xCyclopedia)

LOLBAS Execute 1 Sigma rule name it 2 ATT&CK techniques 1 documented command 10 known copies with hashes

How unregmp2.exe is abused

documented by LOLBAS

Execute T1202 Indirect Command Execution

Run by rmdir.exe: mkdir copy cmd

-s

-q

-v

-c

-hidewmp

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for unregmp2.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1202 Indirect Command Execution User privileges

Allows an attacker to copy a target binary to a controlled directory and modify the 'ProgramW6432' environment variable to point to that controlled directory, then execute 'unregmp2.exe' with argument '/HideWMP' which will spawn a process at the hijacked path '%ProgramW6432%\wmpnscfg.exe'.

rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"

Identify

Trips 6 Sigma rules: highLOL-Binary Copied From System Directory by Nasreddine Bencherchali (Nextron Systems); highSuspicious Calculator Usage by Florian Roth (Nextron Systems); mediumLolbin Unregmp2.exe Use As Proxy by frack113; mediumSuspicious Copy From or To System Directory by Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems); lowCMD Shell Output Redirect by frack113; lowDirectory Removal Via Rmdir by frack113

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for unregmp2.exe, by Wade Hickey, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for unregmp2.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumLolbin Unregmp2.exe Use As Proxyfrack113

T1202Indirect Command Execution

T1218System Binary Proxy Execution

Is it the real unregmp2.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft Windows Media Player Setup Utility

10 known copies

12.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\unregmp2.exe · signed by Microsoft Windows

55231ee05bf4b890092c9dede553dd1ce458d829be2b4357204e6deb65b005d3

12.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\unregmp2.exe · signed by Microsoft Windows

f9af19cc25b23c572cab738672348c09b6d757b6983e6e2d06c3024cefae8355

12.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\unregmp2.exe · signed by Microsoft Windows

21f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d

12.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\unregmp2.exe · signed by Microsoft Windows

cc883043adccfa1dd61b3da09d89940f3b97a6e74a09aa32d0d339b0553cd728

12.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\unregmp2.exe · signed by Microsoft Windows

8b9ecd5fa290a630f13e016f37a8f45f493b0de67a85cd11c86580c8861bdd21

12.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\unregmp2.exe · signed by Microsoft Windows

a09ea06072956c0f8dd7b46793de05de1eb6a34eb32cfda17b674060fa200193

12.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\unregmp2.exe · signed by Microsoft Windows

1df2f5fc3369f5901068ad9463d7a165fd8e7ee7a12ca6c1a88992bb1484632e

12.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\unregmp2.exe · signed by Microsoft Windows

df160aced402899269a07872038e7cebe64cbb24dd09d8a4474b12aa6f760653

12.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\unregmp2.exe · signed by Microsoft Windows

c9abd0b301ec1472dc12e6d8333228af97d9831f55d6b2df17e4b36393580006

12.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\unregmp2.exe · signed by Microsoft Windows

deba397177c965811e35b502d515956cc419781233334fb47cefda850021f216

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.