441b726bae004e4dfaf1d803a596e15d1d2d8b0dc3651b545821933d34e0a6af

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2023 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

y2mate.com - Gojo Geto 五條 Oを取得 AmvEdit_1080pFHR.mp4
Size

25.5MB
MD5

bd37dd5f0a6d471cbb405fcd37ee02b7
SHA1

72d5ed80b76b241e7df3d07e1725210947b261d6
SHA256

441b726bae004e4dfaf1d803a596e15d1d2d8b0dc3651b545821933d34e0a6af
SHA512

90c6349df5cd62b047bbfb5cac76f850ce68e9bb158bff206f39acc13469d2f13b85cea215bf838430ddf9ba4ae50275fe016c48f3780bcb6c2423476fbb187d
SSDEEP

786432:I5n/hzwVThI1W6G4OMJ/piz1xAb473s+TNUSF+Qj:OpiTACMJxiz0b4VNUSoQj

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4912	unregmp2.exe
Token: SeCreatePagefilePrivilege	4912	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4448	4528	wmplayer.exe	85
PID 4528 wrote to memory of 4448	4528	wmplayer.exe	85
PID 4528 wrote to memory of 4448	4528	wmplayer.exe	85
PID 4528 wrote to memory of 2660	4528	wmplayer.exe	86
PID 4528 wrote to memory of 2660	4528	wmplayer.exe	86
PID 4528 wrote to memory of 2660	4528	wmplayer.exe	86
PID 2660 wrote to memory of 4912	2660	unregmp2.exe	87
PID 2660 wrote to memory of 4912	2660	unregmp2.exe	87

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\y2mate.com - Gojo Geto 五條 Oを取得 AmvEdit_1080pFHR.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\y2mate.com - Gojo Geto 五條 Oを取得 AmvEdit_1080pFHR.mp4"
  2⤵
  PID:4448
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
fc240c081ec382df4b74d591d7d37a45

SHA1
396e9d8accb2ff8b32e6c3957808cb87d23ad47c

SHA256
8cfeb277627a0fc9f2596c83dc37f9a3d8871293cd88dadd08f32098bf936038

SHA512
d8f83773c330b88b43f9ebc6220aa98368854e44a75b73a8575e7171f6c32e784d404e5a2e2e7787d3c71c0cfecdbb983631b639d9fee879b374d498d2ef0ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
751ad9a4c6591c8fd8e83f5ffcf1eefd

SHA1
971d2494f4728082b0a975ae41b457405de7b5e1

SHA256
dea2d7f3de60307975385d3399646e5c57266f73172c875ae3e8b2f6a87ade1f

SHA512
5c8d31a2432c2779c1ad1343bfc5ed215101a1f145c5eff3d1a15344861956025cabe4c46deff2d0fe79624db678c89255e92f31798a3f9ea0dbbcfd67451da9

Download Submit