995dc8fea0544829a10b8d6ce279e9430266f1316e41df66d6465bf4dd6dbea8

Analysis

max time kernel
35s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The_Rock_quadruple_vine_boom_sound_effects_you.mp4
Size 402KB
Sample240303-lyny5agg81
SHA256 995dc8fea0544829a10b8d6ce279e9430266f1316e41df66d6465bf4dd6dbea8
MD5 5cd594dd980651d420d945494f1012ab
SHA1 2266cede268b3d52c4e5a2453d865a7e6d057f73
SHA512 e9ceafad2ce61e8ca6dce6270e4ba7a88164a605ef0e0e750968137d8b8df3d563e9e0d9e9269cd64a669fd610261c77a8d56d4ccaf08ba0001f800014d31743
SSDEEP 12288:FfTfKigrNYJsskq9t9XjuEDUYlTCurKAb:FfOC0q9t1juEDlTCurKW
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{34BD666D-C835-4A7D-B567-5D5C87B7F723}	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2264	unregmp2.exe
Token: SeCreatePagefilePrivilege	2264	unregmp2.exe
Token: SeShutdownPrivilege	4092	wmplayer.exe
Token: SeCreatePagefilePrivilege	4092	wmplayer.exe
Token: 33	1132	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1132	AUDIODG.EXE
Token: SeShutdownPrivilege	4092	wmplayer.exe
Token: SeCreatePagefilePrivilege	4092	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4092	wmplayer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1496	2296	wmplayer.exe	88
PID 2296 wrote to memory of 1496	2296	wmplayer.exe	88
PID 2296 wrote to memory of 1496	2296	wmplayer.exe	88
PID 2296 wrote to memory of 2200	2296	wmplayer.exe	90
PID 2296 wrote to memory of 2200	2296	wmplayer.exe	90
PID 2296 wrote to memory of 2200	2296	wmplayer.exe	90
PID 2200 wrote to memory of 2264	2200	unregmp2.exe	91
PID 2200 wrote to memory of 2264	2200	unregmp2.exe	91
PID 1496 wrote to memory of 508	1496	setup_wm.exe	96
PID 1496 wrote to memory of 508	1496	setup_wm.exe	96
PID 1496 wrote to memory of 508	1496	setup_wm.exe	96
PID 508 wrote to memory of 1424	508	unregmp2.exe	97
PID 508 wrote to memory of 1424	508	unregmp2.exe	97
PID 1496 wrote to memory of 4092	1496	setup_wm.exe	98
PID 1496 wrote to memory of 4092	1496	setup_wm.exe	98
PID 1496 wrote to memory of 4092	1496	setup_wm.exe	98

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\The_Rock_quadruple_vine_boom_sound_effects_you.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\The_Rock_quadruple_vine_boom_sound_effects_you.mp4"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:1424
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\The_Rock_quadruple_vine_boom_sound_effects_you.mp4"
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4092
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x540 0x53c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 dfd76fd8ae4d04c006729be160e7c23fe8e003e7094a54abf3a5aaee1a5c5590
MD5 dbfc662304aa4236ac6c685fdd3ee597
SHA1 bee96b9256c93a35398a8c6a341da9470c6101c2
SHA512 6730c50e8217e93d819b24a76af50ed9afeb34c73f32bcf65cca1bac139219c4897f7a43faa7a88909b32777420f47beb2a1ab23fad5886ef4da35226305c42b
SSDEEP 3:LqPallkltlsl7pl+e/llsIXplsMlZI1Xlldl0lcNklltlwzl4hR/mll:eW+1E3+eNXplskZI10cAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 245403594cb11c39b7852f25f66d50ec356612a1ce1cb341e7d2ffa85b59d487
MD5 728180cec5b72c3524d0851343dfc2a7
SHA1 7290577aaae2efcbc3706e1d820216a8eb1addcb
SHA512 6eb60296125676eb9e73d62e222496cd00121d5b5efaf0247f6d1bd45dd2f266016424a5f7f9745d7063a783a81e5e4840223c47b7601812ffa8b12627d04454
SSDEEP 768:O0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:gZP2tFP3vqY8KqEMnWTaBacg
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 287c7c895df0b057344c871aa59274ac146b8496482854d765434e6a73caede6
MD5 a4e1aa25ae02a190cdfea05ca3b8894e
SHA1 7c90ed54f74e3b4426d5bf4f9e8b1c0e8e6ee157
SHA512 86ab919a61c986bad05b7a99f1618aa042915152d57d21f38c3bdee90d78c7dd2c5db9e5c0542e4f499fcf2b1dce34d0a135d3926313ddd1638f241f5276ea28
MD5 SHA1 SHA512

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 2KB
SHA256 ec566fa0cf8dc62ff80595cf43c3efee8078d1dd3c7aac1be224f9653c3846b6
MD5 881a2416d58da5d85c2679f2914867b6
SHA1 ca410ecbbd798583cf8a4c855c7f6559e7952cf3
SHA512 ba116f70f5fd831ac7e66596a82b27a0173c827e0a20b2509d64d36210ef44636f2660f64d26d96676b894e16c2f15afa72c34f6879f56dd88e1c9acb2d3a0bb
MD5 SHA1 SHA512

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 c28de900cf722eb32f92b803f5bd83df8bcfdacdde7b45b7f1c08a650439b6f8
MD5 330c321f948d5309262eb0735b0ca90e
SHA1 a793182bab0ceb64479b0c3b7f18fefaece36af0
SHA512 c7b9d53cb48c2e04a055b49128a251801d08c05de4462f76ed9de64bd3f8989a9504c51ae8c28ec7f2b8de24964d722e7f06d5c1ff1a62b88b6bf2c443673c00
MD5 SHA1 SHA512

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 7548e4628778d079de6f502d2f27c8fa9b06516f5f0070dc4212ec347f997aa9
MD5 11eea394479caa6d545867d500ab91d3
SHA1 f73262e975af141aef28939c19e8ebb5246c4b3f
SHA512 ac327b3e13aad6edc2646d1fa33e0932a9b3da7e0f018d5f7af5529a3a36148a4d64e57eace7ce86ef9dbc2dcf25da16d270d163a75560ce1e14eb173c87cb84
MD5 SHA1 SHA512

Submit Download

memory/4092-117-0x0000000003AF0000-0x0000000003B00000-memory.dmp

Download

memory/4092-125-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-48-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-47-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-50-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-51-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-52-0x0000000006840000-0x0000000006850000-memory.dmp

Download

memory/4092-53-0x0000000006840000-0x0000000006850000-memory.dmp

Download

memory/4092-54-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-55-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-56-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-57-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-59-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-58-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-60-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-123-0x0000000005490000-0x00000000054A0000-memory.dmp

Download

memory/4092-62-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-75-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-76-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-77-0x0000000003AF0000-0x0000000003B00000-memory.dmp

Download

memory/4092-78-0x0000000003AF0000-0x0000000003B00000-memory.dmp

Download

memory/4092-79-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-80-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-81-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-83-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-82-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-84-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-85-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-86-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-87-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-88-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-89-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-90-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-92-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-93-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-94-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-91-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-95-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-96-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-97-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-98-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-99-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-100-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-101-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-102-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-103-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-104-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-106-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-107-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-105-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-108-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-109-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-110-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-111-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-112-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-113-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-114-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-116-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-118-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-45-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-120-0x0000000003AF0000-0x0000000003B00000-memory.dmp

Download

memory/4092-121-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-46-0x0000000005E90000-0x0000000005EA0000-memory.dmp

Download

memory/4092-119-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-61-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-124-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-122-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-129-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-131-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-135-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-136-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-138-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-137-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/4092-134-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-139-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-140-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/4092-133-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-132-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-130-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-128-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-127-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-126-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-115-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-141-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-142-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-144-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-145-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-143-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-147-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-146-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-148-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-149-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-150-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-152-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-153-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-154-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-157-0x0000000003AF0000-0x0000000003B00000-memory.dmp

Download

memory/4092-159-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-160-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-162-0x0000000005490000-0x00000000054A0000-memory.dmp

Download

memory/4092-163-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-161-0x0000000003AF0000-0x0000000003B00000-memory.dmp

Download

memory/4092-171-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-170-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-158-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-156-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-175-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-155-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-176-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-151-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-177-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/4092-184-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-185-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-186-0x0000000005510000-0x0000000005520000-memory.dmp

Download

memory/4092-191-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-192-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-193-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-198-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-199-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-200-0x0000000003AF0000-0x0000000003B00000-memory.dmp

Download

memory/4092-202-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-203-0x0000000005490000-0x00000000054A0000-memory.dmp

Download

memory/4092-209-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-210-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-216-0x0000000005480000-0x0000000005490000-memory.dmp

Download

memory/4092-217-0x0000000006A30000-0x0000000006A40000-memory.dmp

Download

memory/4092-218-0x0000000005510000-0x0000000005520000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads