bea0714c016960dfa97069125eb49ed1c2517c050e9e0a723efe850254d16938

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setting File/Operating Video/Letter A setting.mp4
Size

4.2MB
MD5

d08d8a2cf145344da21670ea1e13db89
SHA1

354987c44f4d651bfc49d7ae17e9c9aa19bb7d5d
SHA256

a837035dba65b31241acbd3da19d657d981b4c622370fcdbc76b89a326135e13
SHA512

c5f0ce0e14cb18e3bd87c4ebf48dc44a1d37b78501327fd0f78f8cfa43f531c33b2c6d62901811949f4408587a57ef4be625c86486d8a6d446381fe0fbdb033f
SSDEEP

98304:rvsv8SYsoFps0hoIoho9gWKqgOB4XghRPLU2NwD:r0RYsons0hofho9DZkXpx

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5116	unregmp2.exe
Token: SeCreatePagefilePrivilege	5116	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1124	984	wmplayer.exe	80
PID 984 wrote to memory of 1124	984	wmplayer.exe	80
PID 984 wrote to memory of 1124	984	wmplayer.exe	80
PID 984 wrote to memory of 3776	984	wmplayer.exe	81
PID 984 wrote to memory of 3776	984	wmplayer.exe	81
PID 984 wrote to memory of 3776	984	wmplayer.exe	81
PID 3776 wrote to memory of 5116	3776	unregmp2.exe	82
PID 3776 wrote to memory of 5116	3776	unregmp2.exe	82

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Setting File\Operating Video\Letter A setting.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Setting File\Operating Video\Letter A setting.mp4"
  2⤵
  PID:1124
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
d6759da50ee5a07863cda56cb089face

SHA1
88c02af048af957cd671c401db5eaf916cb39788

SHA256
044c3178c09fbfd71707924d6971edb048ae8b62d6811ae4283cb20f102bca69

SHA512
fadf5cb9b31b65b9f307ff4c438778f9f5ce9b0a9430a2a8f3151eaa874d738263b0579d0b816a53617bda688993526b12dd452be330d891f93fbea9b32e1a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
2b89370dc91afd31591eb39cb2396dc1

SHA1
6010f3e04cba904b6b583c38a6eb5654cbb3b5a2

SHA256
3d15e438d7be6697bb2b55a1cb6181914ab1e6afe3f51d089d708784b959b6f7

SHA512
79fa2167949498a1008eed089df7981db17eb932c16af8f1f8a970b281bc65cd3309f2e97ebb37364ba757deee86ab8ab5f0a246abd79fd2925bcfbee9107b06

Download Submit