fca3c3b7bf2dca89cd5e2575a40e6a3cfd76d17875a9e234bf87a1528923eec1

Analysis

max time kernel
64s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
robloxapp-20220715-1109004.wmv
Size 26.8MB
Sample220916-wvlppsgdb6
SHA256 fca3c3b7bf2dca89cd5e2575a40e6a3cfd76d17875a9e234bf87a1528923eec1
MD5 d0fb3da40e7f3196796c0ea0ed80ca05
SHA1 b979f6ffac9bdbc00ca1f96d021f65e9680f04fc
SHA512 0543419f1c775daff12951c87ecfade8f9b11333b9b328f8a6f05f378a66ec3e89ba64a0afed65062c19845540a95daa71d8b315f212a968b8b1d9b4ccdfa192
SSDEEP 786432:MJ4/XqbR8n1hr62V7GbkP78oBrsWv0/Xh:6LRYr64GbyXBrsQq
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2160	unregmp2.exe
Token: SeCreatePagefilePrivilege	2160	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4992	2224	wmplayer.exe	80
PID 2224 wrote to memory of 4992	2224	wmplayer.exe	80
PID 2224 wrote to memory of 4992	2224	wmplayer.exe	80
PID 2224 wrote to memory of 5024	2224	wmplayer.exe	81
PID 2224 wrote to memory of 5024	2224	wmplayer.exe	81
PID 2224 wrote to memory of 5024	2224	wmplayer.exe	81
PID 5024 wrote to memory of 2160	5024	unregmp2.exe	82
PID 5024 wrote to memory of 2160	5024	unregmp2.exe	82

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "C:\Users\Admin\AppData\Local\Temp\robloxapp-20220715-1109004.wmv"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "C:\Users\Admin\AppData\Local\Temp\robloxapp-20220715-1109004.wmv"
  2⤵
  PID:4992
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 2dad2789112b5ecf44b6aab668cb4438c9dd9517696dc4dfba4706f1bdceabdf
MD5 c13e388b5cfb770fd7413245fb3ba071
SHA1 290eef9e6e75035c1cf582817db6bc213d60a2c4
SHA512 d4c3445de69d9911c7a304ba18b2b51fd38bb6d02c09817d62c84488a2b7d2321c600573a8bd96ecd6ed7dbe383b2312f797da539ab80fe91d29b792072988c4
MD5 SHA1 SHA512

Submit Download