3e65a0f6429a65faa9969381fdf2c3d6b7dde532c3afa8dc93633733b98951ec

Analysis

max time kernel
47s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2022, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

audio.mp3
Size

173KB
MD5

8788e907cc51987eed585423339e7e81
SHA1

bc16bd1ff6df0b3454c0b5a143760f978522e15e
SHA256

3e65a0f6429a65faa9969381fdf2c3d6b7dde532c3afa8dc93633733b98951ec
SHA512

2fd4f6c2ba32f1e1d3212af215d840d145567f754689e1604535fc8d0bea80823c3aba80e28b937af2cfabfb9c7c97a67f7d43a8fa30e6d9db3df4b02a52137b
SSDEEP

3072:/zyy5GYa9y58Zv0MSlEppkPgUJ87FGuigN1HsdfTLaAslaKoOLQj:OB9y5O0MSlE0PcR1MDsl0OE

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\F:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	unregmp2.exe
Token: SeCreatePagefilePrivilege	5004	unregmp2.exe
Token: SeShutdownPrivilege	4916	wmplayer.exe
Token: SeCreatePagefilePrivilege	4916	wmplayer.exe
Token: 33	3308	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3308	AUDIODG.EXE
Token: SeShutdownPrivilege	4916	wmplayer.exe
Token: SeCreatePagefilePrivilege	4916	wmplayer.exe
Token: SeShutdownPrivilege	4916	wmplayer.exe
Token: SeCreatePagefilePrivilege	4916	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4916	wmplayer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3140	4220	wmplayer.exe	83
PID 4220 wrote to memory of 3140	4220	wmplayer.exe	83
PID 4220 wrote to memory of 3140	4220	wmplayer.exe	83
PID 4220 wrote to memory of 4924	4220	wmplayer.exe	84
PID 4220 wrote to memory of 4924	4220	wmplayer.exe	84
PID 4220 wrote to memory of 4924	4220	wmplayer.exe	84
PID 4924 wrote to memory of 5004	4924	unregmp2.exe	85
PID 4924 wrote to memory of 5004	4924	unregmp2.exe	85
PID 3140 wrote to memory of 3024	3140	setup_wm.exe	99
PID 3140 wrote to memory of 3024	3140	setup_wm.exe	99
PID 3140 wrote to memory of 3024	3140	setup_wm.exe	99
PID 3024 wrote to memory of 1520	3024	unregmp2.exe	100
PID 3024 wrote to memory of 1520	3024	unregmp2.exe	100
PID 3140 wrote to memory of 4916	3140	setup_wm.exe	101
PID 3140 wrote to memory of 4916	3140	setup_wm.exe	101
PID 3140 wrote to memory of 4916	3140	setup_wm.exe	101

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\audio.mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\audio.mp3"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:1520
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\audio.mp3"
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4916
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
23f5744f99821234c9adf6f8dee3e66d

SHA1
f10a1ab4914c0508e177dfac2220645162b2f151

SHA256
8aae89931e2650cef52ab1c563786a609b2061eba68bc7f6f17ae8a4547a6fab

SHA512
b0f20abf17351136b26de9bc75e8f97e96e7776cef1f0684a7727102278edbfc73f321a949bb74e0e5c6354e8317be69dba665cdfaaf832bf024df7ded66c9a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
1623f0d765905b5b74368899bf49f36e

SHA1
ae3d7e9e20bd2219601109ab5218e3463c93401d

SHA256
c474709c172474bef7b2cbc8a203c77feec5cb9accbc8c3eb2e50ad2b6d0bbb9

SHA512
f3200288846782aee65435a89e779bf991ae4c375b272dfd969520e2cd7c3c5d185d002aad346f15526b1dfc4ea173a304825521143b9776d497947a9c3753f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
b3fcc5733ca5afe692761aac83e9e5a0

SHA1
d471caa23267ba2ded9e8c1d2c11cea6dd4738ce

SHA256
0d09c9a36f17755b369d587ba2e7f5b0e1d1f1fa383160564746b444bdcb82e7

SHA512
975aacd68c64eb87fd38ebfaf68d6ec67603b8356ec46cae4b8f0e8e035811bdb8d6c069e6883444e86faa0c45820e8b235a3257651395b73cdce49606eeb1f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
2KB

MD5
7faa0f89bae5509a488b454ab0d76b76

SHA1
7d7eb267a2e6feac182dddbf16fea6a81e45d65a

SHA256
0a0ad1c0d0566082a3dbba79e09c2ec03ae0ce88cac5a44547125da2296a904d

SHA512
7375724f70efa47ea76bd3e4fdf4660893cd2fd106713bae457307959cbb0294b8f71bc71f10bab23f16def35152ba0c3650be70155b64c183f815dae738dc9c

Download Submit
memory/4916-170-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-177-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-144-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-145-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-146-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-147-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-148-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-142-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-149-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-152-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-153-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-155-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-156-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/4916-157-0x0000000006590000-0x00000000065A0000-memory.dmp

Filesize
64KB

Download
memory/4916-154-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-158-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-159-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-161-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-160-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-162-0x0000000009CE0000-0x0000000009CF0000-memory.dmp

Filesize
64KB

Download
memory/4916-163-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-165-0x0000000009CE0000-0x0000000009CF0000-memory.dmp

Filesize
64KB

Download
memory/4916-166-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-167-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-164-0x0000000009CE0000-0x0000000009CF0000-memory.dmp

Filesize
64KB

Download
memory/4916-168-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-169-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4916-171-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-172-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-143-0x0000000003E50000-0x0000000003E60000-memory.dmp

Filesize
64KB

Download
memory/4916-173-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-183-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-174-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4916-176-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-178-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-179-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4916-180-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-181-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-182-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-175-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4916-185-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-186-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-187-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4916-188-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4916-184-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-189-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-190-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4916-191-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-192-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4916-193-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-194-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-195-0x0000000006340000-0x0000000006350000-memory.dmp

Filesize
64KB

Download
memory/4916-196-0x0000000006340000-0x0000000006350000-memory.dmp

Filesize
64KB

Download
memory/4916-197-0x0000000006340000-0x0000000006350000-memory.dmp

Filesize
64KB

Download
memory/4916-198-0x0000000009C10000-0x0000000009C20000-memory.dmp

Filesize
64KB

Download
memory/4916-199-0x0000000009CF0000-0x0000000009D00000-memory.dmp

Filesize
64KB

Download
memory/4916-200-0x0000000007530000-0x0000000007540000-memory.dmp

Filesize
64KB

Download
memory/4916-201-0x0000000006340000-0x0000000006350000-memory.dmp

Filesize
64KB

Download
memory/4916-202-0x0000000005FB0000-0x0000000005FC0000-memory.dmp

Filesize
64KB

Download
memory/4916-203-0x0000000005FB0000-0x0000000005FC0000-memory.dmp

Filesize
64KB

Download
memory/4916-204-0x0000000005FB0000-0x0000000005FC0000-memory.dmp

Filesize
64KB

Download