b28a55d70226acd543491a8936e7003eb4727676b9b2823e9a49900f83a8bdee

Analysis

max time kernel
48s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

.mp4
Size

219KB
MD5

f6acf88bb50e535ac62ac59be062bf2d
SHA1

bc865d816d255f5e74c229a8386c378c7a3945d0
SHA256

b28a55d70226acd543491a8936e7003eb4727676b9b2823e9a49900f83a8bdee
SHA512

59dc12914e40627cc7af280652ca0fac8f84f21df7082a94d3d77b477e9a8c258bc8decc3f9fbaced995e560d7def2fd8d84d9aa17828297abad9cc2d83c9595
SSDEEP

6144:HLxMuzrePHg8nkmJPGlMCSPyCAMf2z02uU2c:mWrezG+VaGf2zD2c

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1888637039-960448630-940472005-1000\{D71751EC-7D8E-4525-97B4-D3B99B2B5CC3}	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2652	unregmp2.exe
Token: SeCreatePagefilePrivilege	2652	unregmp2.exe
Token: SeShutdownPrivilege	3604	wmplayer.exe
Token: SeCreatePagefilePrivilege	3604	wmplayer.exe
Token: 33	2260	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2260	AUDIODG.EXE
Token: SeShutdownPrivilege	3604	wmplayer.exe
Token: SeCreatePagefilePrivilege	3604	wmplayer.exe
Token: SeShutdownPrivilege	3604	wmplayer.exe
Token: SeCreatePagefilePrivilege	3604	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3604	wmplayer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1240	1180	wmplayer.exe	81
PID 1180 wrote to memory of 1240	1180	wmplayer.exe	81
PID 1180 wrote to memory of 1240	1180	wmplayer.exe	81
PID 1180 wrote to memory of 4552	1180	wmplayer.exe	82
PID 1180 wrote to memory of 4552	1180	wmplayer.exe	82
PID 1180 wrote to memory of 4552	1180	wmplayer.exe	82
PID 4552 wrote to memory of 2652	4552	unregmp2.exe	83
PID 4552 wrote to memory of 2652	4552	unregmp2.exe	83
PID 1240 wrote to memory of 4584	1240	setup_wm.exe	84
PID 1240 wrote to memory of 4584	1240	setup_wm.exe	84
PID 1240 wrote to memory of 4584	1240	setup_wm.exe	84
PID 4584 wrote to memory of 1804	4584	unregmp2.exe	85
PID 4584 wrote to memory of 1804	4584	unregmp2.exe	85
PID 1240 wrote to memory of 3604	1240	setup_wm.exe	87
PID 1240 wrote to memory of 3604	1240	setup_wm.exe	87
PID 1240 wrote to memory of 3604	1240	setup_wm.exe	87

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\.mp4"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:1804
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\.mp4"
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3604
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x478
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
987a07b978cfe12e4ce45e513ef86619

SHA1
22eec9a9b2e83ad33bedc59e3205f86590b7d40c

SHA256
f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

SHA512
39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
465bd1b004981b7386ac6e9aba7e07ad

SHA1
952f8daa62c121fe77a48791293ecf166af45bb5

SHA256
3cf40b72556c063292d3297edecaf7b8850809aeef7f14c03d924df5f5f74396

SHA512
31a9a02af507623bb92487e19c2e310b74f46918c949ddee1f50785234404c311f55909f0a9a41b2a5c2a4c0cfa3b7970a5b86c866851ea5314dfcdc0e7871ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
db6e8bbb968b31d0b12494e69bfe44ae

SHA1
7ba44de0b61002fd536d625b175dc2b9dc512605

SHA256
52a74effcf2ef02b8ea2aecee60d0ec3cc1bf69e172e1695fb80e602c98e5e07

SHA512
a831d3934e7f2389b3cc91492653fa3ed3f770de11ce85f0fe74201e2a7b8e05603121a493dada6cf747dc3a4023b04a4d7257aec6228bfd2a7330f6058d4b1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
aa25ce67b555c9423b9bfa58689cfc6a

SHA1
d570a870ac2ae9817a9f1ff0192be581359477e7

SHA256
77d3dcf9f0587fe9301dae0fd2b59bd561b462560e2fa232884497d02dfcea20

SHA512
abe85bf1f7534a0fad10896cea836583d5a61100c5f1f57038d605c5856ccc145cda42154bce70b253631f69e0f86d32dc58e464ae77f097bfb8addae1758a2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
a5455dca214a3af12e577353de25b876

SHA1
28717fe9d2f8c2d4de7a6f8b45b3665e807b05b7

SHA256
1df28d7a504aaaaa1f81fe01abc3e3ec45ed3bae03a900633d7315e078302b6c

SHA512
6d838e70c2cac915e77331f9db625341a21ac1b3eaebd2892cc880bb4dc215fb5e5fe5c0c69efa80a7179b3fe3c3572545c6a027d61e0cae2a4307a4b0f57baa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
5bddff086652979eaf11751c582f35e4

SHA1
dab1c32384964dce2d61ebec9398027621ebb479

SHA256
ed138b4a4871147e0da5089a185eed1ac6d72d247a30a6f35c6d508422f536e3

SHA512
03d171c7232ce720f64a667bff17452f3f1669a3c460f52398cc9a1afb483ca7ae1bded1a784b020b1cd941ab69327373291282effff5f9adb9fcd4ff0e0282d

Download Submit
memory/3604-110-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-119-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-47-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-45-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-48-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/3604-49-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/3604-50-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-52-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-53-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-54-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-55-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-56-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-57-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-58-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-63-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-117-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-65-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-66-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-68-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-67-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/3604-69-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-70-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-71-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-72-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-73-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-74-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-76-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-78-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-79-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-77-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-80-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-81-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-75-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-82-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-83-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-84-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-85-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-87-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-88-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-89-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-86-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-90-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-91-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-92-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-93-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-94-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-95-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-96-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-97-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-98-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-100-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-99-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-101-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-103-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-104-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-105-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-106-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-107-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-109-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-44-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-111-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-112-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-46-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-115-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-64-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-116-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-118-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-114-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-120-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-113-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-121-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-122-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-123-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-124-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-125-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-126-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-128-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-129-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-127-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-130-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-132-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-133-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-134-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-135-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-136-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-138-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-141-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-142-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-140-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-139-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-143-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-144-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-145-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-146-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-147-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-148-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-152-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-153-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-160-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-159-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-161-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-163-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-169-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-173-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-174-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-180-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-181-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-182-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-185-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-184-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-194-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-195-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-198-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-199-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-203-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-202-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-209-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-210-0x0000000008DC0000-0x0000000008DD0000-memory.dmp

Filesize
64KB

Download
memory/3604-219-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-220-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-222-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-223-0x0000000008A80000-0x0000000008A90000-memory.dmp

Filesize
64KB

Download
memory/3604-228-0x0000000008DC0000-0x0000000008DC2000-memory.dmp

Filesize
8KB

Download
memory/3604-227-0x0000000008DB0000-0x0000000008DC0000-memory.dmp

Filesize
64KB

Download
memory/3604-229-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download
memory/3604-41-0x0000000003F00000-0x0000000003F10000-memory.dmp

Filesize
64KB

Download
memory/3604-238-0x0000000008880000-0x0000000008890000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads