Analysis
-
max time kernel
1625s -
max time network
1590s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-01-2023 08:52
Static task
static1
Behavioral task
behavioral1
Sample
slamransomware2.1.exe
Resource
win10v2004-20220812-en
General
-
Target
slamransomware2.1.exe
-
Size
3.9MB
-
MD5
b4c5397ba985fe7770a4822f28343198
-
SHA1
18bb6536a8caa53fa006b0e78d4c4097ecee583f
-
SHA256
acb3d1eab482ba2428084e53cc04fbe08fed4c603861e9ce116b4e9aad2096cf
-
SHA512
c8b2ce7b61c5fda173ce404c4ca602a794db016a942a44fe50236dd3a54c047fb022c2772446e87744caeb5da02a3111e9169a0cebf83fca2e5c57fd765e3013
-
SSDEEP
49152:nbX8LRHjOGjBlB4XyGOkNdVxzyK8LRHjOGjBlB4XyGOkNdV5A:bX88cIyGOk3188cIyGOk3jA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
uac.exepid process 2132 uac.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
unregmp2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP" unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0" unregmp2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
slamransomware2.1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation slamransomware2.1.exe -
Loads dropped DLL 3 IoCs
Processes:
uac.exepid process 2132 uac.exe 2132 uac.exe 2132 uac.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
unregmp2.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
wmplayer.exeunregmp2.exedescription ioc process File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\F: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe -
Drops file in Program Files directory 1 IoCs
Processes:
unregmp2.exedescription ioc process File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe unregmp2.exe -
Drops file in Windows directory 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 64 IoCs
Processes:
unregmp2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867} unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF} unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command unregmp2.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2100 vlc.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
taskmgr.exepid process 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2100 vlc.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
unregmp2.exewmplayer.exetaskmgr.exedescription pid process Token: SeShutdownPrivilege 1796 unregmp2.exe Token: SeCreatePagefilePrivilege 1796 unregmp2.exe Token: SeShutdownPrivilege 932 wmplayer.exe Token: SeCreatePagefilePrivilege 932 wmplayer.exe Token: SeDebugPrivilege 4600 taskmgr.exe Token: SeSystemProfilePrivilege 4600 taskmgr.exe Token: SeCreateGlobalPrivilege 4600 taskmgr.exe Token: 33 4600 taskmgr.exe Token: SeIncBasePriorityPrivilege 4600 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
vlc.exewmplayer.exetaskmgr.exepid process 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 932 wmplayer.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
Processes:
vlc.exetaskmgr.exepid process 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 2100 vlc.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe 4600 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2100 vlc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
slamransomware2.1.execmd.exewmplayer.exeunregmp2.exesetup_wm.exeunregmp2.exedescription pid process target process PID 4656 wrote to memory of 2436 4656 slamransomware2.1.exe cmd.exe PID 4656 wrote to memory of 2436 4656 slamransomware2.1.exe cmd.exe PID 4656 wrote to memory of 2436 4656 slamransomware2.1.exe cmd.exe PID 2436 wrote to memory of 2132 2436 cmd.exe uac.exe PID 2436 wrote to memory of 2132 2436 cmd.exe uac.exe PID 2436 wrote to memory of 2132 2436 cmd.exe uac.exe PID 4216 wrote to memory of 3140 4216 wmplayer.exe setup_wm.exe PID 4216 wrote to memory of 3140 4216 wmplayer.exe setup_wm.exe PID 4216 wrote to memory of 3140 4216 wmplayer.exe setup_wm.exe PID 4216 wrote to memory of 2432 4216 wmplayer.exe unregmp2.exe PID 4216 wrote to memory of 2432 4216 wmplayer.exe unregmp2.exe PID 4216 wrote to memory of 2432 4216 wmplayer.exe unregmp2.exe PID 2432 wrote to memory of 1796 2432 unregmp2.exe unregmp2.exe PID 2432 wrote to memory of 1796 2432 unregmp2.exe unregmp2.exe PID 3140 wrote to memory of 5084 3140 setup_wm.exe unregmp2.exe PID 3140 wrote to memory of 5084 3140 setup_wm.exe unregmp2.exe PID 3140 wrote to memory of 5084 3140 setup_wm.exe unregmp2.exe PID 5084 wrote to memory of 2468 5084 unregmp2.exe unregmp2.exe PID 5084 wrote to memory of 2468 5084 unregmp2.exe unregmp2.exe PID 3140 wrote to memory of 932 3140 setup_wm.exe wmplayer.exe PID 3140 wrote to memory of 932 3140 setup_wm.exe wmplayer.exe PID 3140 wrote to memory of 932 3140 setup_wm.exe wmplayer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\slamransomware2.1.exe"C:\Users\Admin\AppData\Local\Temp\slamransomware2.1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6D93.tmp\slamloader.bat" "C:\Users\Admin\AppData\Local\Temp\slamransomware2.1.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\temp\uac.exeuac.exe 34 C:\temp\slam.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SubmitRegister.aiff"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exeC:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT4⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\GrantFormat.midi3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
1024KB
MD5f9ecf076ae351c6df6e82bf3fe7132d7
SHA17a1b13bcabd5789ff26320cf5c326754354e9af7
SHA256ab0fb9fdb3d76e8a92c8abf9b641f1742d47205df88120fbf60a4f48568209cf
SHA51225491a2386a6d31761891ee8c2059d3d279027b17850914287a7ba9b2b65422d6d54dc5b8637ee124c98c3e5878b4f4b5f2153051539e2669616bb77b85ab481
-
C:\Users\Admin\AppData\Local\Temp\6D93.tmp\slamloader.batFilesize
220B
MD5dde74ab5efc28a2946e166a97f5743bb
SHA13ee33b652ce15f38559104ebfd4303215c400290
SHA256b4a5de5423c09f118aeffac94004b46c0fc6f67e70d48c62c2b9f2524c5f7f08
SHA512d874ac72c81000d897ed2fd0ce06c124170b8a2b65f8759ab1efaa9ef69b6aaaf241e1d62545449779d1364b58eeaa588c032dcc25aa5e137f7fa2f08c095a84
-
C:\Users\Admin\AppData\Local\Temp\slam.exeFilesize
2.1MB
MD5768722fc2f95bbfd54c366064907acca
SHA14f1c4acb9dfef40555702ab6fcf6b2e086e91652
SHA256d4b35a4c7d82a2584a8ea10b3b4b12f5f19e5e34b6f24fb2a554f0c5c8b7906f
SHA512bc7b099e28a00f9a45d7c767513f69c949d61e932447e0ffce2e0ceb8ecea1bd4f7c725481d250661305530283c3d22dd97cf61c571d5844d66acdda10180180
-
C:\Users\Admin\AppData\Local\Temp\uac.exeFilesize
223KB
MD5e5a75ef124d13c43126f9c20dd9892f9
SHA198eadc4be6f8df785ae5668a623c66ce46e8b366
SHA2562d9dbac4cfc3a9676454ddcae5e4d595509af195177eae680b1f953223973f75
SHA512f4a56a70814e8bc03b5596ba440d70be773db021d3486b7be2b1bacc492212f3fe7f4a2fd5fa22c459c6d67e6a7ce73262331539cc50e1c49dfbfcb339d8a074
-
C:\Users\Admin\AppData\Local\Temp\ucrtbased.dllFilesize
1.4MB
MD5ceeda0b23cdf173bf54f7841c8828b43
SHA11742f10b0c1d1281e5dec67a9f6659c8816738ad
SHA256c297d2bd5c6fcef4c5895cb5c2d191303f87f4c32ad39a9d236c4831d2a809e9
SHA512f6be09560d84da788391741be48c9759935b71d1c556a596a43b9e39aeb605d827d334f42c83a6120d398cdc4c445767e7bd6efa7baea8c872f29db8da7beb89
-
C:\Users\Admin\AppData\Local\Temp\vcruntime140d.dllFilesize
111KB
MD5b59b0f6193bcc7e78a3b2fc730196be3
SHA1045469fec2df2a9c75b550984a0ed32db2e9f846
SHA256003619245b3159385f85757f39947a568d0b386786f81a5a00e71249631e246b
SHA51273cc58cb5f87f2a03a99c461df63740ade5cd97d7c3cd09fd570296627eee5ecfb4a945422cc76f9249281c2ef2d04ee717c2530089b79e3dc0db018b8608a97
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD59e4fc647c1e487e577b72c65ec788623
SHA1d64f9178fe584ca8df49821571395478b85e2593
SHA2563b8e13e91d2c483d7a5d90cd59ba1254bdc6ae9baeff71d08181cd2dd510d4e3
SHA512d013b66484b18dcbd9cb4a60e2ddb2f9597e3553ddd4ea32e007209d6f7f32ab17c9f61fadac8fcc7c3bc1994dc923c7fd2e14c538729a1e2d19aefade1ba271
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
2KB
MD530ea6069c858907e229ca7d0acaa5107
SHA16bf9e4c28c401ee56d6714e6c5037226f72af034
SHA2566005e72800233ad75cdde51c644241d3aee552f0793bd9a152f1537be426438e
SHA512453f5d559e2177e3e168dcf33eb1fe4a0acc48de27f2b34f7950543094445b8f5b0e4eee5966a9230025f2e23b8e3ac27d69fa5ecd25079fed37f6bdf4b190ee
-
C:\temp\uac.exeFilesize
223KB
MD5e5a75ef124d13c43126f9c20dd9892f9
SHA198eadc4be6f8df785ae5668a623c66ce46e8b366
SHA2562d9dbac4cfc3a9676454ddcae5e4d595509af195177eae680b1f953223973f75
SHA512f4a56a70814e8bc03b5596ba440d70be773db021d3486b7be2b1bacc492212f3fe7f4a2fd5fa22c459c6d67e6a7ce73262331539cc50e1c49dfbfcb339d8a074
-
C:\temp\ucrtbased.dllFilesize
1.4MB
MD5ceeda0b23cdf173bf54f7841c8828b43
SHA11742f10b0c1d1281e5dec67a9f6659c8816738ad
SHA256c297d2bd5c6fcef4c5895cb5c2d191303f87f4c32ad39a9d236c4831d2a809e9
SHA512f6be09560d84da788391741be48c9759935b71d1c556a596a43b9e39aeb605d827d334f42c83a6120d398cdc4c445767e7bd6efa7baea8c872f29db8da7beb89
-
C:\temp\ucrtbased.dllFilesize
1.4MB
MD5ceeda0b23cdf173bf54f7841c8828b43
SHA11742f10b0c1d1281e5dec67a9f6659c8816738ad
SHA256c297d2bd5c6fcef4c5895cb5c2d191303f87f4c32ad39a9d236c4831d2a809e9
SHA512f6be09560d84da788391741be48c9759935b71d1c556a596a43b9e39aeb605d827d334f42c83a6120d398cdc4c445767e7bd6efa7baea8c872f29db8da7beb89
-
C:\temp\vcruntime140d.dllFilesize
111KB
MD5b59b0f6193bcc7e78a3b2fc730196be3
SHA1045469fec2df2a9c75b550984a0ed32db2e9f846
SHA256003619245b3159385f85757f39947a568d0b386786f81a5a00e71249631e246b
SHA51273cc58cb5f87f2a03a99c461df63740ade5cd97d7c3cd09fd570296627eee5ecfb4a945422cc76f9249281c2ef2d04ee717c2530089b79e3dc0db018b8608a97
-
memory/932-163-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-157-0x0000000005E80000-0x0000000005E90000-memory.dmpFilesize
64KB
-
memory/932-166-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-165-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-164-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-155-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-150-0x0000000000000000-mapping.dmp
-
memory/932-156-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-154-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-158-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-160-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/932-161-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/1796-146-0x0000000000000000-mapping.dmp
-
memory/2132-143-0x0000000000410000-0x000000000045E000-memory.dmpFilesize
312KB
-
memory/2132-138-0x0000000000000000-mapping.dmp
-
memory/2432-145-0x0000000000000000-mapping.dmp
-
memory/2436-132-0x0000000000000000-mapping.dmp
-
memory/2468-149-0x0000000000000000-mapping.dmp
-
memory/3140-144-0x0000000000000000-mapping.dmp
-
memory/5084-148-0x0000000000000000-mapping.dmp