7e59a2c14c0c40c39517f405785963d1fd2810ad5976c2f30fdbee38f90ef2e6

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 14:48

Target

Windows Media Player/setup_wm.exe
Size

216KB
MD5

0656209990324b66655ccf558b4f5db8
SHA1

4b41ad9545f9f4199a9a9b390b935158e1170a0f
SHA256

69c8e751965cae7e49761784b352186e81640bae41266f3b555a21129b4d9134
SHA512

af0f8e40331bbdbd8648bf07dfecbb30cbdc0af6db8045610e30dbc9770c723bc2330afa8c2e6f2a71cdecda9824d056e4adb9fe7574e471cd3bdcb19283a98b
SSDEEP

6144:uahfYy5+SKxJvLboA9dBM9w14/4ATFXAaC5vB:Lhf7USKH/Ow/X

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SoundRec\WMPrivTest = "WMPrivTest"	setup_wm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\soundrec	setup_wm.exe

C:\Users\Admin\AppData\Local\Temp\Windows Media Player\setup_wm.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Media Player\setup_wm.exe"
1⤵
- Modifies registry class
PID:2512

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact