37b533a715bd962424dd394cd17b2ecdb74bb08d5c2a629b27ecfd25b586cffa

Analysis

max time kernel
100s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hra/LLL_Mantis_Data/StreamingAssets/Dead Space (2023).wav
Size

902KB
MD5

e89e065d7742b003966b9584e9aa08ec
SHA1

b19acbf3291b79df0013128d207207bc15c3daf6
SHA256

279bf910cf83a0f852b31fc15f0efb039afd393dc83cba6d18263b3c5720f7ae
SHA512

0f79feb158e6c9f04a49997719ae0803b5bd972a5b7002d9aaf2e4ad3567b1428539bab4d72f6722aac5e7d93323e691e632aceacc553bdd459700ecba5eec2e
SSDEEP

24576:v4bIlUeb2nHRoZ+ppLvK8tt1oEzkyEslUDIo:v48lonHBk6t9UDZ

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	260	unregmp2.exe
Token: SeCreatePagefilePrivilege	260	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2100	1424	wmplayer.exe	83
PID 1424 wrote to memory of 2100	1424	wmplayer.exe	83
PID 1424 wrote to memory of 2100	1424	wmplayer.exe	83
PID 1424 wrote to memory of 1808	1424	wmplayer.exe	84
PID 1424 wrote to memory of 1808	1424	wmplayer.exe	84
PID 1424 wrote to memory of 1808	1424	wmplayer.exe	84
PID 1808 wrote to memory of 260	1808	unregmp2.exe	85
PID 1808 wrote to memory of 260	1808	unregmp2.exe	85

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\hra\LLL_Mantis_Data\StreamingAssets\Dead Space (2023).wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\hra\LLL_Mantis_Data\StreamingAssets\Dead Space (2023).wav"
  2⤵
  PID:2100
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
ab57d6576bac817e24e09b125a2fc42f

SHA1
0fbec340b8ec1256b89d115f2598853a281312ba

SHA256
1f85be4464de03096c5272ec692fb71cd9f0f6ac485c4f47a984513b3990c5ac

SHA512
d3d1077369971f56eae10b2737552e93658df660fa06b627606c2ee5c8cbff2d0247401ff259d95ce1bc6757e79d869a7acc3bbcf1eadc1a1eaafc9be4d17faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
9b2acf7e1ede725fa8a2985069bba465

SHA1
977e84ca1eb520315456866d31696247be6dcf22

SHA256
a92ced5213711f1e3b6c42c78fcb8e91375670e6608e6c54002a9d316f4c8cae

SHA512
380c78fa7ff59633d23386e79c3b9b96ef4146de3e94c146de14b2f7a1e8b0a0a356b43a2646f7f16322c75fcfb7994f4c9c38a2ae7db99191bd702604355ddd

Download Submit