5fadec9f010a5d113a77bf679677dc607588588405ece51a5aae9103f29f59be

Resubmissions

02/03/2024, 14:16

240302-rllwwsee273

02/03/2024, 14:14

240302-rkgwjseb5w3

02/03/2024, 14:07

240302-reyxwaed683

02/03/2024, 14:02

240302-rb72daed358

Analysis

max time kernel
32s
max time network
51s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
undertale.sf2
Size 147.0MB
Sample240302-rb72daed35
SHA256 5fadec9f010a5d113a77bf679677dc607588588405ece51a5aae9103f29f59be
MD5 670f1159cd259d366cd89ad64503fd3a
SHA1 dda3d7804945603b07aad794db0e172b62edb015
SHA512 ce8b5c4d98d053e79cb662208a9a68bb3c1f60f84a9fe60c33acb59ae1adc96e99d430de21079e1914bf2fcd58ee782859c3468718153d24115d62ed0fee625c
SSDEEP 3145728:IWke6a/HKIO3JXQrM9vf4Uh4ztAOBa9n1UjXEeSNCnoMqZ07pr/KnmjDTzMM:IWVnPeFIwytAkcNCnZq8prisLL
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,7601,17514"	unregmp2.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\WMPShopMusic\ = "{8A734961-C4AA-4741-AC1E-791ACEBF5B39}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.sf2\ = "sf2_auto_file"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file\shell\play\command\ = "\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Play \"%L\""	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file\shell\open\command\ = "\"%ProgramFiles(x86)%\\Windows Media Player\\wmplayer.exe\" /Open \"%L\""	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file\shell\play\ = "&Play"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file\shell\play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9991"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\sf2_auto_file\shell\play\command	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1056	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	wmplayer.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1056	2624	cmd.exe	29
PID 2624 wrote to memory of 1056	2624	cmd.exe	29
PID 2624 wrote to memory of 1056	2624	cmd.exe	29
PID 1056 wrote to memory of 1216	1056	rundll32.exe	30
PID 1056 wrote to memory of 1216	1056	rundll32.exe	30
PID 1056 wrote to memory of 1216	1056	rundll32.exe	30
PID 1056 wrote to memory of 1216	1056	rundll32.exe	30
PID 1216 wrote to memory of 756	1216	wmplayer.exe	31
PID 1216 wrote to memory of 756	1216	wmplayer.exe	31
PID 1216 wrote to memory of 756	1216	wmplayer.exe	31
PID 1216 wrote to memory of 756	1216	wmplayer.exe	31
PID 1216 wrote to memory of 756	1216	wmplayer.exe	31
PID 1216 wrote to memory of 756	1216	wmplayer.exe	31
PID 1216 wrote to memory of 756	1216	wmplayer.exe	31
PID 756 wrote to memory of 1748	756	setup_wm.exe	37
PID 756 wrote to memory of 1748	756	setup_wm.exe	37
PID 756 wrote to memory of 1748	756	setup_wm.exe	37
PID 756 wrote to memory of 1748	756	setup_wm.exe	37
PID 756 wrote to memory of 1748	756	setup_wm.exe	37
PID 756 wrote to memory of 1748	756	setup_wm.exe	37
PID 756 wrote to memory of 1748	756	setup_wm.exe	37
PID 1748 wrote to memory of 2684	1748	unregmp2.exe	38
PID 1748 wrote to memory of 2684	1748	unregmp2.exe	38
PID 1748 wrote to memory of 2684	1748	unregmp2.exe	38
PID 1748 wrote to memory of 2684	1748	unregmp2.exe	38
PID 756 wrote to memory of 2728	756	setup_wm.exe	39
PID 756 wrote to memory of 2728	756	setup_wm.exe	39
PID 756 wrote to memory of 2728	756	setup_wm.exe	39
PID 756 wrote to memory of 2728	756	setup_wm.exe	39
PID 756 wrote to memory of 2728	756	setup_wm.exe	39
PID 756 wrote to memory of 2728	756	setup_wm.exe	39
PID 756 wrote to memory of 2728	756	setup_wm.exe	39
PID 756 wrote to memory of 1596	756	setup_wm.exe	40
PID 756 wrote to memory of 1596	756	setup_wm.exe	40
PID 756 wrote to memory of 1596	756	setup_wm.exe	40
PID 756 wrote to memory of 1596	756	setup_wm.exe	40
PID 2728 wrote to memory of 1716	2728	unregmp2.exe	41
PID 2728 wrote to memory of 1716	2728	unregmp2.exe	41
PID 2728 wrote to memory of 1716	2728	unregmp2.exe	41
PID 2728 wrote to memory of 1716	2728	unregmp2.exe	41

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\undertale.sf2
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\undertale.sf2
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Local\Temp\undertale.sf2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Local\Temp\undertale.sf2"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Windows\SysWOW64\unregmp2.exe
        
        C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
        6⤵
        Modifies Installed Components in the registry
        Drops desktop.ini file(s)
        Drops file in Program Files directory
        Modifies registry class
        
        PID:2684
    - - C:\Windows\SysWOW64\unregmp2.exe
        
        "C:\Windows\system32\unregmp2.exe" /PerformIndivIfNeeded
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2728
      - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /PerformIndivIfNeeded /REENTRANT
        6⤵
        
        PID:1716
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play "C:\Users\Admin\AppData\Local\Temp\undertale.sf2"
        5⤵
        Enumerates connected drives
        Suspicious use of FindShellTrayWindow
        
        PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_372.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb
Size 1.0MB
SHA256 a116a3620421498fd5ad3a29ce4500cb13eff841ee9ab3e8629545afd417944e
MD5 f7df3810840fcf4c4a4214d971d6112b
SHA1 225627416d27ef0723d97ddac9e2c46e7bd5be21
SHA512 8375316b2619b548257b319973ed2eb40b19d86b3974a51ba9f208e6c5bc2eff9bafcf8d47bbb9b44ac80eaf25014c8e8bffd3c28c198536f3934710b3fcb27c
SSDEEP 768:upZXIaJlmLHhIZfAibz/xtdCS/KCMNd51XLW9URfNRWTMwDBPXatZz/MUmhWBpEE:usW+Wgpx7CvSgG1zvTadadW
MD5 SHA1 SHA512 SSDEEP

Submit Download

allservices.xml

Path C:\Users\Admin\AppData\Local\Temp\tmp48694.WMC\allservices.xml
Size 546B
SHA256 155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba
MD5 df03e65b8e082f24dab09c57bc9c6241
SHA1 6b0dacbf38744c9a381830e6a5dc4c71bd7cedbf
SHA512 ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99
MD5 SHA1 SHA512

Submit Download

serviceinfo.xml

Path C:\Users\Admin\AppData\Local\Temp\tmp50676.WMC\serviceinfo.xml
Size 523B
SHA256 93acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad
MD5 d58da90d6dc51f97cb84dfbffe2b2300
SHA1 5f86b06b992a3146cb698a99932ead57a5ec4666
SHA512 7f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636
MD5 SHA1 SHA512

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 3KB
SHA256 c45e9338c9cc720df88850640b87fb0eee1f0a347161d8f2300db509e15e234e
MD5 6fb8265512142a55549c20a9b464f004
SHA1 0870dd69f9d24ffe57ee973351770ff992ef9903
SHA512 283be11d559b04e74e57cd089010a68f809d1f2d646133cff8e9fd36ada4ad753f2ca79514cf63f6ae8d60b2ec4145cca52517697fc0fa71be3b0bc6fbde4ce4
MD5 SHA1 SHA512

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 4KB
SHA256 e2f6a0205d32d6ac04ed77bc33e393294bf70a3826e73b6f8367bb274e5076f8
MD5 b71aae563636869494ed1a88af141352
SHA1 d42ca9f007a7e437ae98e2457928022a087e4100
SHA512 44d0acdfea77068d2c6c5dae813cbf4a04fc3dd353bbed500142670b19793f262d3c26f238920b5f61b5321c1e53f5c6a9403dce377762b0661c3e7c4cb633d1
SSDEEP 96:o3th63wOgGzh6bgGuhH6/gNp/h9wkPgI3ZaYS/dqEd9G4hH6UGbhH6nF:om3w9GoMGx/kprkdqEd9GfUGQF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1596-42-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/1596-63-0x0000000004140000-0x000000000414A000-memory.dmp

Download

memory/1596-74-0x0000000073B40000-0x0000000073C31000-memory.dmp

Download

memory/1596-67-0x0000000073B40000-0x0000000073C31000-memory.dmp

Download

memory/1596-61-0x0000000004140000-0x000000000414A000-memory.dmp

Download

memory/1596-62-0x0000000004140000-0x000000000414A000-memory.dmp

Download

memory/1596-65-0x0000000004140000-0x000000000414A000-memory.dmp

Download

memory/1596-64-0x0000000004140000-0x000000000414A000-memory.dmp

Download

memory/1596-66-0x0000000004140000-0x000000000414A000-memory.dmp

Download

memory/1716-49-0x000007FEF5A90000-0x000007FEF5B61000-memory.dmp

Download

memory/1716-58-0x000007FEF5B70000-0x000007FEF5C32000-memory.dmp

Download

memory/1716-59-0x000007FEF5A90000-0x000007FEF5B61000-memory.dmp

Download

memory/1716-60-0x000007FEF6CE0000-0x000007FEF6E08000-memory.dmp

Download

memory/1716-48-0x000007FEF6CE0000-0x000007FEF6E08000-memory.dmp

Download

memory/1716-38-0x000007FEF5B70000-0x000007FEF5C32000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads