c148c4ae4e093b3653496766f69a01b2fff54fce595836e71373efc8e4ee6794

Analysis

max time kernel
91s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sound_out3.wav
Size

8KB
MD5

8f3443508cef3459923d37ebbd2baf9e
SHA1

7d531c599ca500c4593db0be8b92abd5585fba36
SHA256

7b0b31c55a3f9daae0edc299895c43907b7d118b3ea9565835151abf7d58e482
SHA512

c89db18aedc46b6ebaf1e08cc492bef3393a8b8469b9c13c4ea1296d75d6110e4bfb5343c234861ce5bae834eed2e9998e5c405d8290659a769db76e6b1e9f9f
SSDEEP

192:PBrw8knTlV1dzRmTFE+olwtg+0sdok7gr5h:PBrw8knpVFmbmwtgC77g5h

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

unregmp2.exe

description	ioc	process
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

unregmp2.exe

description pid process

Token: SeShutdownPrivilege 808 unregmp2.exe
Token: SeCreatePagefilePrivilege 808 unregmp2.exe

description	pid	process
Token: SeShutdownPrivilege	808	unregmp2.exe
Token: SeCreatePagefilePrivilege	808	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

wmplayer.exeunregmp2.exe

description	pid	process	target process
PID 4964 wrote to memory of 1160	4964	wmplayer.exe	setup_wm.exe
PID 4964 wrote to memory of 1160	4964	wmplayer.exe	setup_wm.exe
PID 4964 wrote to memory of 1160	4964	wmplayer.exe	setup_wm.exe
PID 4964 wrote to memory of 5044	4964	wmplayer.exe	unregmp2.exe
PID 4964 wrote to memory of 5044	4964	wmplayer.exe	unregmp2.exe
PID 4964 wrote to memory of 5044	4964	wmplayer.exe	unregmp2.exe
PID 5044 wrote to memory of 808	5044	unregmp2.exe	unregmp2.exe
PID 5044 wrote to memory of 808	5044	unregmp2.exe	unregmp2.exe

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\sound_out3.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\sound_out3.wav"
2⤵
PID:1160

C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
2⤵
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Filesize
256KB

MD5
ab57d6576bac817e24e09b125a2fc42f

SHA1
0fbec340b8ec1256b89d115f2598853a281312ba

SHA256
1f85be4464de03096c5272ec692fb71cd9f0f6ac485c4f47a984513b3990c5ac

SHA512
d3d1077369971f56eae10b2737552e93658df660fa06b627606c2ee5c8cbff2d0247401ff259d95ce1bc6757e79d869a7acc3bbcf1eadc1a1eaafc9be4d17faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Filesize
1KB

MD5
1dc51ffe1b31ea5441821327288fcc29

SHA1
df27ba93564467b76ed47c59e3312c653b3b7636

SHA256
c66469fe5f074e9699df29bcaffa87c09bbbd229084645f9a2a94b8ca361b79c

SHA512
77b09ca47bb7da6823bd08919210deb2bf1836a48fec246b1afe1c6922aa25f947cd265f2c1d6741281b0576e6083716e0ec073d7b55024e141c83c86ea205fb

Download Submit