Overview
overview
7Static
static
7Changed.v0...21.rar
windows7-x64
3Changed.v0...21.rar
windows10-2004-x64
3Changed Sp...er.ini
windows7-x64
1Changed Sp...er.ini
windows10-2004-x64
1Changed Sp...ve.txt
windows7-x64
1Changed Sp...ve.txt
windows10-2004-x64
1Changed Sp...me.txt
windows7-x64
1Changed Sp...me.txt
windows10-2004-x64
1Changed Sp...ge.txt
windows7-x64
1Changed Sp...ge.txt
windows10-2004-x64
1Changed Sp...rt.txt
windows7-x64
1Changed Sp...rt.txt
windows10-2004-x64
1Changed Sp...id.txt
windows7-x64
1Changed Sp...id.txt
windows10-2004-x64
1Changed Sp...id.txt
windows7-x64
1Changed Sp...id.txt
windows10-2004-x64
1Changed Sp.../1.wav
windows7-x64
1Changed Sp.../1.wav
windows10-2004-x64
6Changed Sp...10.wav
windows7-x64
1Changed Sp...10.wav
windows10-2004-x64
6Changed Sp...11.wav
windows7-x64
1Changed Sp...11.wav
windows10-2004-x64
6Changed Sp...12.wav
windows7-x64
1Changed Sp...12.wav
windows10-2004-x64
6Changed Sp...13.wav
windows7-x64
1Changed Sp...13.wav
windows10-2004-x64
6Changed Sp...14.wav
windows7-x64
1Changed Sp...14.wav
windows10-2004-x64
6Changed Sp...15.wav
windows7-x64
1Changed Sp...15.wav
windows10-2004-x64
6Changed Sp...16.wav
windows7-x64
1Changed Sp...16.wav
windows10-2004-x64
6Analysis
-
max time kernel
150s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2023 13:46
Behavioral task
behavioral1
Sample
Changed.v01.02.2021.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Changed.v01.02.2021.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Changed Special/coldclientloader.ini
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Changed Special/coldclientloader.ini
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
Changed Special/local_save.txt
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Changed Special/local_save.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Changed Special/steam_settings/settings/account_name.txt
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Changed Special/steam_settings/settings/account_name.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Changed Special/steam_settings/settings/language.txt
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Changed Special/steam_settings/settings/language.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Changed Special/steam_settings/settings/listen_port.txt
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Changed Special/steam_settings/settings/listen_port.txt
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
Changed Special/steam_settings/settings/user_steam_id.txt
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Changed Special/steam_settings/settings/user_steam_id.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Changed Special/steam_settings/steam_appid.txt
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Changed Special/steam_settings/steam_appid.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/1.wav
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/1.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/10.wav
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/10.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/11.wav
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/11.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/12.wav
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/12.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/13.wav
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/13.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/14.wav
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/14.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/15.wav
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/15.wav
Resource
win10v2004-20230221-en
Behavioral task
behavioral31
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/16.wav
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/16.wav
Resource
win10v2004-20230220-en
General
-
Target
Changed Special/steamapps/common/Changed Special/Audio/BGM/14.wav
-
Size
5.4MB
-
MD5
ffd6bebfebca8df2ba3b6945596ddb38
-
SHA1
327e525561706c6327653dc0566d14a340b6e2bc
-
SHA256
411ec37f9e2d73449f8ae9c28c416dabac18d53ba979162300cdac6a00abefbc
-
SHA512
03576c80692f9fa9677c6aa2412368cd0d4b4811c55a76c00606676a2b6789205212f30face96fab1c9f725320537b6e33a42d395ce587691871203b75ca116c
-
SSDEEP
98304:G05AnEL/oIKUj4zv48MYg+C9v7md01JtKpC18gU3a955AmKxttyTB9fRCYUzLMM3:GCjmYd1u4bYttyKO3A
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unregmp2.exedescription pid process Token: SeShutdownPrivilege 3948 unregmp2.exe Token: SeCreatePagefilePrivilege 3948 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wmplayer.exeunregmp2.exedescription pid process target process PID 2636 wrote to memory of 4920 2636 wmplayer.exe setup_wm.exe PID 2636 wrote to memory of 4920 2636 wmplayer.exe setup_wm.exe PID 2636 wrote to memory of 4920 2636 wmplayer.exe setup_wm.exe PID 2636 wrote to memory of 3924 2636 wmplayer.exe unregmp2.exe PID 2636 wrote to memory of 3924 2636 wmplayer.exe unregmp2.exe PID 2636 wrote to memory of 3924 2636 wmplayer.exe unregmp2.exe PID 3924 wrote to memory of 3948 3924 unregmp2.exe unregmp2.exe PID 3924 wrote to memory of 3948 3924 unregmp2.exe unregmp2.exe
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Changed Special\steamapps\common\Changed Special\Audio\BGM\14.wav"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Changed Special\steamapps\common\Changed Special\Audio\BGM\14.wav"2⤵
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
64KB
MD5dbfc662304aa4236ac6c685fdd3ee597
SHA1bee96b9256c93a35398a8c6a341da9470c6101c2
SHA256dfd76fd8ae4d04c006729be160e7c23fe8e003e7094a54abf3a5aaee1a5c5590
SHA5126730c50e8217e93d819b24a76af50ed9afeb34c73f32bcf65cca1bac139219c4897f7a43faa7a88909b32777420f47beb2a1ab23fad5886ef4da35226305c42b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD515b1420469efe56f73846b8bc6001f27
SHA139ab40185a94cd4706b6ba057b69f5455f7777e4
SHA256320fc68ef6c8c34fbda97cd6aa669c652e1e1530960507df79c66baadc5db17d
SHA512cd0e84a6fa139c746580f744df2b12ceca61a479ec3191d91694b00839cfbf5b79ab56ffc23a5612de26cb293d1ea95391683e3e37ab849452dad76b4682fea6