2a198f370ff2d9c2afbec879a0dc84d1d60f59077178c67bff6a5f4b4210be8f

Analysis

max time kernel
86s
max time network
198s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
12/01/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setting File/Setting File/Romoral User Manual/Operating Video/Led Setting.mp4
Size

2.6MB
MD5

9a241dc939a700e4f68189d46395eed1
SHA1

bb8084082d95af491db706d1559be28e8e20513d
SHA256

622ad2cdb868d975f58657313efaa13e624e26b2ba728013ae8319792ecde855
SHA512

7801d8eb8d6a9d7ed92fd0c156d2a75fefe1574bc406599b4abbd16740dacbda0df5597aa2fb46abd22bb83dd30d8919fcc7ad1b2ff2d042a0e053e4a937bf3f
SSDEEP

24576:eX+BBv7I4ICoKR2KjWlFp2SfYuEsl/0DPJQpAvKKADrLup/yEe82OCrBGd8TbZ2A:kk7ZICoO29Dp2SPl8KAYrLWyX8oBZbv

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4028	unregmp2.exe
Token: SeCreatePagefilePrivilege	4028	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 5020	1100	wmplayer.exe	81
PID 1100 wrote to memory of 5020	1100	wmplayer.exe	81
PID 1100 wrote to memory of 5020	1100	wmplayer.exe	81
PID 1100 wrote to memory of 1440	1100	wmplayer.exe	82
PID 1100 wrote to memory of 1440	1100	wmplayer.exe	82
PID 1100 wrote to memory of 1440	1100	wmplayer.exe	82
PID 1440 wrote to memory of 4028	1440	unregmp2.exe	83
PID 1440 wrote to memory of 4028	1440	unregmp2.exe	83

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Setting File\Setting File\Romoral User Manual\Operating Video\Led Setting.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Setting File\Setting File\Romoral User Manual\Operating Video\Led Setting.mp4"
  2⤵
  PID:5020
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
bbb416e94d91b0dfbb49e250efb4e183

SHA1
bbf9700fd646ed2de62e7efc230b578e7cb5d414

SHA256
82302657180df4c8f2f81df34d3150f263b1a51773fc168b0b639906163d0dd5

SHA512
13d07ae391a9429f508a052aa7c6fa39fdc1d18963e2697f7918229dbebcaf937c65fa4209099178a9ca66e8ccb48544f24a073ca24837e65983f1517b054d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
24e1c2ca764b41796b5f62131583ee9d

SHA1
7d93bf67fc4e7a2b593966448d7698c1979cd6ea

SHA256
63190f29ae0f2c99d010817768c9fa2461463c46ed23961b82794bd292835053

SHA512
e506ca9a94db831e512a355a8bd93ae905c8b144588b1a290c3cd9b6df7a5f66071acd8ada44c5995e142f772f4e1ef6facadf8dfd7dc2ac8f360d1548beeee6

Download Submit