567c79524a0b45a199dba1bc92e1ce65ae88163e0f7e35008b9ff6eff820d1b2

Analysis

max time kernel
80s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Snitz Lärare Intron.mov
Size

763.0MB
MD5

cc5545974475e44079ea18f6207ed270
SHA1

f9a00da2502866ce6a462417f9bc4c0e1215cee6
SHA256

567c79524a0b45a199dba1bc92e1ce65ae88163e0f7e35008b9ff6eff820d1b2
SHA512

0f8639b168c60c8d087c2ce220f02687a729a29344fd620609064c2b48e2cb5d6ffc0ad3d037edf3bae744c1baef8e6b84ed4e86485163404a5b0133789af106
SSDEEP

3145728:DsJ71r6Dmfb4JyGQfnTEswGkwUdPZoTPKR82lfr858DQ0qX5pNa:DVYGiTEGnU8OVB858c0qX5pNa

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\F:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{AFC0A136-ADB5-485F-9FD0-774733FF7545}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1808	unregmp2.exe
Token: SeCreatePagefilePrivilege	1808	unregmp2.exe
Token: SeShutdownPrivilege	4744	wmplayer.exe
Token: SeCreatePagefilePrivilege	4744	wmplayer.exe
Token: 33	2316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2316	AUDIODG.EXE
Token: SeShutdownPrivilege	4744	wmplayer.exe
Token: SeCreatePagefilePrivilege	4744	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4744	wmplayer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4808	3516	wmplayer.exe	81
PID 3516 wrote to memory of 4808	3516	wmplayer.exe	81
PID 3516 wrote to memory of 4808	3516	wmplayer.exe	81
PID 3516 wrote to memory of 3756	3516	wmplayer.exe	82
PID 3516 wrote to memory of 3756	3516	wmplayer.exe	82
PID 3516 wrote to memory of 3756	3516	wmplayer.exe	82
PID 3756 wrote to memory of 1808	3756	unregmp2.exe	83
PID 3756 wrote to memory of 1808	3756	unregmp2.exe	83
PID 4808 wrote to memory of 5088	4808	setup_wm.exe	91
PID 4808 wrote to memory of 5088	4808	setup_wm.exe	91
PID 4808 wrote to memory of 5088	4808	setup_wm.exe	91
PID 5088 wrote to memory of 4680	5088	unregmp2.exe	92
PID 5088 wrote to memory of 4680	5088	unregmp2.exe	92
PID 4808 wrote to memory of 4744	4808	setup_wm.exe	93
PID 4808 wrote to memory of 4744	4808	setup_wm.exe	93
PID 4808 wrote to memory of 4744	4808	setup_wm.exe	93

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Snitz Lärare Intron.mov"
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Snitz Lärare Intron.mov"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:4680
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Snitz Lärare Intron.mov"
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4744
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
9c481a94abc7eee23cd5234262e60077

SHA1
2873225e708fb5461ac60c3613fe12112423f0f0

SHA256
681c9665d741ca6ed709cdd79d070ff7f4fdf158e02342f7d47e90a6d962b061

SHA512
0579499b5f01649f7e5e3afad07b4c7924d30fbc56dd12b37d9ad46bdefe35fcb6371694c1eff6c42d56c21b1de4c4f40531b27cd32eca1bdf51c6cac41fe668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
4d0e9122c7c6d6a5eff89d8e5790240d

SHA1
c86de8a99cf2f0d271e4d8998449c662ab36e850

SHA256
4517f0b2d4a031b470cf96f9bf077afdc5b3f1ee21c205ba78ac1190d03e7357

SHA512
f271f19b9aa1ecec1804f2de87f83cc66621e44b4a715ec58c4b4b5ec8a02be40e657ed7b1f54a160b07577ddf8c5cc012f386a0ec101e4956d10429b782523d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
6be34ae2cceb2a9979a43f1b86804b9e

SHA1
bbf47611434bdfe04d2474a092f4e3650950b6f2

SHA256
41bd7d79f27c5ff4d7638408838f63955f7b1e0924039dccc557e33df3c0768e

SHA512
2a29c35765184c0aea549909e3c70864c71fd27f4cde06881d52be49c5239e6e973788c9d73036708361daf681d78ff4e935d4a8c05d2cd641603dfddc1bf821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
8a442730eacb2311b948e2b19203dcd7

SHA1
2ef39c9d231e1599861722e069b4c1321bf75cb0

SHA256
8259dae43418592c7d946bad9841b46e6d14ce36e63b8b03400da2327ef401e6

SHA512
e253872a0e6795dbf97cb7a2ac79c7ec5fc5702fd8b490e84d0a7fbed729bd25e03d1d71a0d83ceb8bd732cfb37c50dd8eafd14836ed60fba211dd31be82fff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
2KB

MD5
16e4ebbcbd0843d1bf89003eeb01c323

SHA1
e4bf9f06adea511128312b44b0d0ce48aa5ba1cc

SHA256
7cfadaf49a66889d5a5654086532ec2e9cefc243b8188a4f631d4d76f4dbe84f

SHA512
08b2202c11b98736f64f3b5066197912f12697454acf4e0a46c0a78f1af3954112240f46784e2125735eaef44e478940dbae4863e3a712b8fc741feecae0f032

Download Submit
memory/4744-179-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-178-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-180-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-181-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-182-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-183-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-185-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-186-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-187-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-184-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-188-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-189-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-190-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-191-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-193-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-192-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/4744-195-0x0000000008D00000-0x0000000008D01000-memory.dmp

Filesize
4KB

Download
memory/4744-198-0x00000000066B0000-0x00000000066C0000-memory.dmp

Filesize
64KB

Download
memory/4744-199-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-200-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-201-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-202-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-204-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-205-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-206-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-207-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-208-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-210-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-209-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-211-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-212-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-214-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-216-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-215-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-213-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-218-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-217-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-220-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-221-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-223-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-224-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-222-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-226-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-225-0x00000000066B0000-0x00000000066C0000-memory.dmp

Filesize
64KB

Download
memory/4744-227-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-229-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-228-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-232-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-231-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-230-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-236-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-235-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-234-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-233-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-238-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-239-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-242-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-241-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-240-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-243-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-244-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-245-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-248-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-247-0x0000000006820000-0x0000000006830000-memory.dmp

Filesize
64KB

Download
memory/4744-249-0x0000000008CE0000-0x0000000008CF0000-memory.dmp

Filesize
64KB

Download
memory/4744-252-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/4744-253-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/4744-254-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/4744-324-0x00000000067C0000-0x00000000067CC000-memory.dmp

Filesize
48KB

Download
memory/4744-325-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-391-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-392-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-393-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-394-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-390-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-451-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-452-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-453-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-457-0x0000000006430000-0x0000000006432000-memory.dmp

Filesize
8KB

Download
memory/4744-456-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-521-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-522-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-519-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-517-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-515-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-513-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-652-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-653-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-650-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-648-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-646-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-644-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-791-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-790-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-789-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-788-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-787-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-931-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/4744-930-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/4744-929-0x0000000006830000-0x0000000006840000-memory.dmp

Filesize
64KB

Download
memory/4744-1062-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1063-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1064-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1065-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1066-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1067-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1127-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1128-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1129-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1130-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1131-0x0000000006430000-0x0000000006432000-memory.dmp

Filesize
8KB

Download
memory/4744-1192-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1193-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1194-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1195-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1196-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1197-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1198-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1199-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1265-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1266-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1267-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1268-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1269-0x00000000067C0000-0x00000000067D0000-memory.dmp

Filesize
64KB

Download
memory/4744-1339-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1340-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1341-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download
memory/4744-1342-0x0000000006430000-0x0000000006440000-memory.dmp

Filesize
64KB

Download