Analysis

  • max time kernel
    25s
  • max time network
    43s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/03/2024, 16:28

General

  • Target

  • Size

    53KB

  • MD5

    6536b10e5a713803d034c607d2de19e3

  • SHA1

    a6000c05f565a36d2250bdab2ce78f505ca624b7

  • SHA256

    775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

  • SHA512

    61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

  • SSDEEP

    1536:ynqAKryDLrASOcRw52sjzIUK7RkYrJ2lrKX:SNdMT8Z8cX

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Control Panel 21 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\msinfo32.exe
    "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\HideEnable.nfo"
    1⤵
    • Checks SCSI registry key(s)
    • Enumerates system info in registry
    PID:216
  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
      2⤵
        PID:2308
      • C:\Windows\SysWOW64\unregmp2.exe
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Windows\System32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
          3⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:3372
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\NewCopy.docm" /o ""
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3616
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\NewCopy.docm" /o ""
      1⤵
        PID:1076
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\GetRequest.odt"
        1⤵
          PID:1252
        • C:\Windows\system32\msinfo32.exe
          "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\HideEnable.nfo"
          1⤵
            PID:4620
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
            1⤵
              PID:2732
            • C:\Windows\system32\browser_broker.exe
              C:\Windows\system32\browser_broker.exe -Embedding
              1⤵
                PID:4184
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                  PID:2408
                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                  1⤵
                    PID:1680
                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                    1⤵
                      PID:2204
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                      1⤵
                        PID:396

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                              Filesize

                              64KB

                              MD5

                              0e807656bd86f2aef7ccf207f963973b

                              SHA1

                              27052af8d103d134369e356b793eb88ba873df55

                              SHA256

                              c509c498682bec50142782a51785655020bea27652f46e104e07a530c2ff5162

                              SHA512

                              e6c7d5e001e8322ccb1abd101d47e7f1401597518f45dd8da1d757728147262bcb3b1f96128f291e0e367c5b34026b401468e4219b27cf3c37a8d434180cd8f3

                            • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4F398924-F001-4C4A-B205-D555F0538505

                              Filesize

                              160KB

                              MD5

                              bc592e37a22535a30a54b262b57e15d8

                              SHA1

                              739deaca786b0c5c03ad42295f07a34cf38beeec

                              SHA256

                              f7f92bd9260b0a84db6ab72615f428a9dfd149c3b183b686d826fd6f465dbe74

                              SHA512

                              4d223fb0818e20b4e1b3bf6756f473df2baadf5cff2fbfbf7b15d318bc8433b0a9d4c75d8649a46e6f94e7970d70e4adbad35b975179e9b11541b1c7e7513336

                            • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

                              Filesize

                              8KB

                              MD5

                              d6f790e9092792ec798abaff6d5b7692

                              SHA1

                              19c4dd5a1ab6cbe4d4c6dc01af7a903f31a25bbf

                              SHA256

                              cbb884793cdbfea7fcc7abdabf846d8d0e368f13824236e1cc8bb5616a6e45ce

                              SHA512

                              595af12cf1d1aa1a2f06fe68c6012909c41356dfc8921f27a8522a16be285c6788a796039ae5ae6956a01c0416f924313c653b854f48ea397f7b208c3b38dac9

                            • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\74a0ad00a184813f0b8867eb2f8dfef7227a18a4.tbres

                              Filesize

                              2KB

                              MD5

                              54d28c7816baa9dda1c88b0ea57623bb

                              SHA1

                              89bbd55270a05fa4efaf6fd6095bf91d480d98ab

                              SHA256

                              772414f615d8ba5d1e1357f5a1e03c57814f13d71f92b58c9e609f927ab29d01

                              SHA512

                              47538b78d7b78f69f3abd0f1903bba72ab964ddace6d931a16b50af93f0997f324d21d99802ec10a2a0ab98b3722dc2241e063ad966426c868fd409d61b6baad

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

                              Filesize

                              9KB

                              MD5

                              7050d5ae8acfbe560fa11073fef8185d

                              SHA1

                              5bc38e77ff06785fe0aec5a345c4ccd15752560e

                              SHA256

                              cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                              SHA512

                              a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                            • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!121\Microsoft\Windows\3720402701\2219095117.pri

                              Filesize

                              207KB

                              MD5

                              e2b88765ee31470114e866d939a8f2c6

                              SHA1

                              e0a53b8511186ff308a0507b6304fb16cabd4e1f

                              SHA256

                              523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

                              SHA512

                              462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

                            • C:\Users\Admin\AppData\Local\Temp\tmp28390.WMC\allservices.xml

                              Filesize

                              546B

                              MD5

                              df03e65b8e082f24dab09c57bc9c6241

                              SHA1

                              6b0dacbf38744c9a381830e6a5dc4c71bd7cedbf

                              SHA256

                              155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba

                              SHA512

                              ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99

                            • C:\Users\Admin\AppData\Local\Temp\tmp31484.WMC\serviceinfo.xml

                              Filesize

                              523B

                              MD5

                              d58da90d6dc51f97cb84dfbffe2b2300

                              SHA1

                              5f86b06b992a3146cb698a99932ead57a5ec4666

                              SHA256

                              93acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad

                              SHA512

                              7f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636

                            • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

                              Filesize

                              1KB

                              MD5

                              557b5ff876a2be11fc93b5f49b3457ca

                              SHA1

                              5b2603ad1089bbb3dcd297936d09d8a4575dbd76

                              SHA256

                              1bfad6a29150153ceb9cd16f12548ba7a565d76857b43b1b75a06459635f8de3

                              SHA512

                              da6afe412d98380964b230cd1b8634e8b5baa5dfc493b4791157d25ffbcaf9d674bb5b5ad4201ff3482f8da432b74650db13d91210c60952ffdf1b0174684e45

                            • memory/396-462-0x00000244F4500000-0x00000244F4600000-memory.dmp

                              Filesize

                              1024KB

                            • memory/396-465-0x0000024CF81E0000-0x0000024CF82E0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/396-335-0x0000024CF89E0000-0x0000024CF8AE0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/396-449-0x0000024CF8EE0000-0x0000024CF8FE0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/396-459-0x0000024CF6700000-0x0000024CF6800000-memory.dmp

                              Filesize

                              1024KB

                            • memory/396-400-0x0000024CF8DE0000-0x0000024CF8EE0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/1076-95-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB

                            • memory/1076-96-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-89-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-83-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-99-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-97-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB

                            • memory/1076-98-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp

                              Filesize

                              696KB

                            • memory/1076-93-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-94-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB

                            • memory/1076-92-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB

                            • memory/1076-91-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-87-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-85-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1076-84-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1252-129-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1252-131-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp

                              Filesize

                              696KB

                            • memory/1252-119-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1252-122-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp

                              Filesize

                              696KB

                            • memory/1252-114-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1252-124-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1252-127-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/2012-0-0x0000000000400000-0x0000000000414000-memory.dmp

                              Filesize

                              80KB

                            • memory/2204-360-0x00000224E8500000-0x00000224E8600000-memory.dmp

                              Filesize

                              1024KB

                            • memory/2204-381-0x00000224E8800000-0x00000224E8900000-memory.dmp

                              Filesize

                              1024KB

                            • memory/2204-488-0x00000224E8A00000-0x00000224E8B00000-memory.dmp

                              Filesize

                              1024KB

                            • memory/2732-138-0x00000172D9D20000-0x00000172D9D30000-memory.dmp

                              Filesize

                              64KB

                            • memory/2732-154-0x00000172DA500000-0x00000172DA510000-memory.dmp

                              Filesize

                              64KB

                            • memory/2732-173-0x00000172D8FE0000-0x00000172D8FE2000-memory.dmp

                              Filesize

                              8KB

                            • memory/3616-57-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-68-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-50-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-110-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-111-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-54-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-51-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-56-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-80-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-62-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-61-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-49-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-65-0x00007FFF40300000-0x00007FFF40310000-memory.dmp

                              Filesize

                              64KB

                            • memory/3616-66-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-64-0x00007FFF80550000-0x00007FFF805FE000-memory.dmp

                              Filesize

                              696KB

                            • memory/3616-52-0x00007FFF40300000-0x00007FFF40310000-memory.dmp

                              Filesize

                              64KB

                            • memory/3616-47-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-45-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-44-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-70-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-72-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-43-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB

                            • memory/3616-42-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-41-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB

                            • memory/3616-39-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB

                            • memory/3616-40-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-75-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-38-0x00007FFF82FF0000-0x00007FFF831CB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/3616-37-0x00007FFF43080000-0x00007FFF43090000-memory.dmp

                              Filesize

                              64KB