Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
14/10/2023, 12:48
231014-p1xktseb9s 414/10/2023, 12:03
231014-n799tsdf8w 314/10/2023, 11:00
231014-m4b27afa32 8Analysis
-
max time kernel
101s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 11:00
Behavioral task
behavioral1
Sample
RPGMV-DECRYPTOR.exe
Resource
win7-20230831-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
RPGMV-DECRYPTOR.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
RPGMV-DECRYPTOR.exe
-
Size
1.2MB
-
MD5
1bdedbe20afb89236a7902804906aeda
-
SHA1
bf9c619e4e672ee1bcb02139d938d8291f3aa1ce
-
SHA256
f8df4d44bd5491dadfcf25353e38b192b629e4af2500bdc9a3816739d7bbd510
-
SHA512
bfc75d03bd782d0d2d947b93d8c462a193e3e5bd22f42dc81e3fd1d490a6a9bce0564b756b4f43018b795bc9ec52b99c71d227bc7edfe353c90e39053a232464
-
SSDEEP
24576:Z/0PTG+usn0/nCocageeHQ6i4W1RH0N7wqHrU26dPFJ9:Z/UTG9umnCoca+w6DW1+iMUzdPFJ
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,7601,17514" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP" unregmp2.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe unregmp2.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\ShellEx\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\WMPShopMusic\ = "{8A734961-C4AA-4741-AC1E-791ACEBF5B39}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo unregmp2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe Token: SeShutdownPrivilege 1424 chrome.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2872 2500 setup_wm.exe 34 PID 2500 wrote to memory of 2872 2500 setup_wm.exe 34 PID 2500 wrote to memory of 2872 2500 setup_wm.exe 34 PID 2500 wrote to memory of 2872 2500 setup_wm.exe 34 PID 2500 wrote to memory of 2872 2500 setup_wm.exe 34 PID 2500 wrote to memory of 2872 2500 setup_wm.exe 34 PID 2500 wrote to memory of 2872 2500 setup_wm.exe 34 PID 2872 wrote to memory of 2988 2872 unregmp2.exe 35 PID 2872 wrote to memory of 2988 2872 unregmp2.exe 35 PID 2872 wrote to memory of 2988 2872 unregmp2.exe 35 PID 2872 wrote to memory of 2988 2872 unregmp2.exe 35 PID 2500 wrote to memory of 3004 2500 setup_wm.exe 36 PID 2500 wrote to memory of 3004 2500 setup_wm.exe 36 PID 2500 wrote to memory of 3004 2500 setup_wm.exe 36 PID 2500 wrote to memory of 3004 2500 setup_wm.exe 36 PID 2500 wrote to memory of 3004 2500 setup_wm.exe 36 PID 2500 wrote to memory of 3004 2500 setup_wm.exe 36 PID 2500 wrote to memory of 3004 2500 setup_wm.exe 36 PID 2500 wrote to memory of 3028 2500 setup_wm.exe 37 PID 2500 wrote to memory of 3028 2500 setup_wm.exe 37 PID 2500 wrote to memory of 3028 2500 setup_wm.exe 37 PID 2500 wrote to memory of 3028 2500 setup_wm.exe 37 PID 3004 wrote to memory of 3024 3004 unregmp2.exe 38 PID 3004 wrote to memory of 3024 3004 unregmp2.exe 38 PID 3004 wrote to memory of 3024 3004 unregmp2.exe 38 PID 3004 wrote to memory of 3024 3004 unregmp2.exe 38 PID 1424 wrote to memory of 1084 1424 chrome.exe 41 PID 1424 wrote to memory of 1084 1424 chrome.exe 41 PID 1424 wrote to memory of 1084 1424 chrome.exe 41 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43 PID 1424 wrote to memory of 2456 1424 chrome.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\RPGMV-DECRYPTOR.exe"C:\Users\Admin\AppData\Local\Temp\RPGMV-DECRYPTOR.exe"1⤵PID:2596
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\unregmp2.exeC:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary2⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT3⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
PID:2988
-
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\system32\unregmp2.exe" /PerformIndivIfNeeded2⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /PerformIndivIfNeeded /REENTRANT3⤵PID:3024
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\RedoPush.wm2⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5b49758,0x7fef5b49768,0x7fef5b497782⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:22⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:82⤵PID:820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:12⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:12⤵PID:872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1384 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:22⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1440 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:12⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1432 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:82⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1412 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:82⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3836 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:12⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4396 --field-trial-handle=1180,i,1290582585167296588,11091726768395595439,131072 /prefetch:12⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5a14254b84526ecf33028515520bfd9bd
SHA1dc173299d8931075491f608513e38700de7e6dd3
SHA25631859ec457c36e6f529d3bc3698ca7ac877bf9c212f014f624a2e40ec63892f4
SHA512217faae42cdc7fdba312240d4e01f91d623b290e6951a6fc75a429a6556ac6e56476a6f3042fa393d7843e36bb9112e57e2260ba1162ba513e42d9b0df13df06
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
199KB
MD5b7da5339114b0bb81f5ac591f367bb0c
SHA1f7d9b70b4a668caa8fca8d6f2b6dcfbb589911d2
SHA2566477e463e529793c65c1323138d09edd6a1018949fe1be1fd5a902897e64ab96
SHA5120694d4240a96607b8b6b8c98d3628f36fb63f7bf883d12dd40a7462f658b7796b277528ec7478eaf8c6bca15ca820486331f1aaf2591fdf8006b5536ccae09d3
-
Filesize
199KB
MD56f26d1caf31277e6ddb8a1e369e9edd8
SHA125f735e3ccca730ae8c16337329fc20243c020e5
SHA2567e2170a82ce799033b23b0f91ce87c53dbdc33aa885251d031f03915027db650
SHA512588b14019176dddb6a6b6c197ce5d677019424bf820e88c329b8cac36dc6ab20e155dda11f4430fd6a695a63828bb40a332d3a241c9bbe6a1e37914058bd99be
-
Filesize
3KB
MD5c30a3ea88ca8f0efa8650224b507ac00
SHA15b5b7d06707d1f9d8f1c9a4a713e703b012bcdcb
SHA25662408209775dba0bcaed0f21b75c22223b4e8583437306d83e01410fecfaeb92
SHA51282bae1dee80bb332dbdcae2d62af935059ab35cf70d140e42ea4825cfc13d62d4044330fa493468cb3cfd2b06d38e54edbe8e3930c4762d206d3a7eaaa6cc0c0
-
Filesize
3KB
MD5e4a2989679c757f5d1162ae66a75d47b
SHA1b14243d035e483128e1a6ccefe6777dcc1942ce3
SHA2564725b97222b42a44cc957b48d02378f23f526d74128711353dd7d3ede9b904ec
SHA512fc3cf4dd6987971998094b44b22ebe994908ca0e3ad09d0a37f5a34ff1e2793e052d1ac5babd4d3b85312a6d0fce076064f4cac8407910a7c6f2a91c47117ee3