Analysis
-
max time kernel
131s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-09-2021 15:18
Static task
static1
Behavioral task
behavioral1
Sample
e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe
-
Size
79KB
-
MD5
936593e1ba2e1fefc78389ed40ab9d9a
-
SHA1
dce566c765b39bca870e374c7f973b432a633fb3
-
SHA256
e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4
-
SHA512
21d3f5f00be88041ee4839a776ed8e7428bcb1e8172d4c4f9af2a7b782c3f89fc4dd57402dbf77d24664b8a99d2d330dc8b231d9d7037564bbc9276c49633017
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1000 636 WerFault.exe 67 -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 1000 WerFault.exe Token: SeBackupPrivilege 1000 WerFault.exe Token: SeDebugPrivilege 1000 WerFault.exe Token: SeShutdownPrivilege 664 unregmp2.exe Token: SeCreatePagefilePrivilege 664 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 496 wrote to memory of 1648 496 wmplayer.exe 78 PID 496 wrote to memory of 1648 496 wmplayer.exe 78 PID 496 wrote to memory of 1648 496 wmplayer.exe 78 PID 496 wrote to memory of 3824 496 wmplayer.exe 79 PID 496 wrote to memory of 3824 496 wmplayer.exe 79 PID 496 wrote to memory of 3824 496 wmplayer.exe 79 PID 3824 wrote to memory of 664 3824 unregmp2.exe 80 PID 3824 wrote to memory of 664 3824 unregmp2.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe"C:\Users\Admin\AppData\Local\Temp\e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe"1⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 2722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding2⤵PID:1648
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\System32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:664
-
-