d4c2bd55d35ca8d761cbbd60ec2c65a76068ca5fc28afd17c75f4881557e1044

Analysis

max time kernel
1484s
max time network
1496s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14/03/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.mp4
Size

94KB
MD5

a16a3390f14b0f0da601559faf14f2a4
SHA1

4ba9ae49104c2a24958f6dafed06ef717ae18c6f
SHA256

d4c2bd55d35ca8d761cbbd60ec2c65a76068ca5fc28afd17c75f4881557e1044
SHA512

e9ee62eea5ab749e633dfb33dbdb69f7b06e9c9ce560d858d9df70a6755111625782dd612b2333e4fd7e7a3c2f71fa8275b6182e45f3159ce5a7dd93c74ad96b
SSDEEP

1536:12A5u7UrT+Uhi/NVOQu7ievzG8g2teutt0U+qP2Xpb1gefB:12GuzUhi/NXevCB2v+pT91ggB

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4284	unregmp2.exe
Token: SeCreatePagefilePrivilege	4284	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 3756	3892	wmplayer.exe	77
PID 3892 wrote to memory of 3756	3892	wmplayer.exe	77
PID 3892 wrote to memory of 3756	3892	wmplayer.exe	77
PID 3892 wrote to memory of 4196	3892	wmplayer.exe	78
PID 3892 wrote to memory of 4196	3892	wmplayer.exe	78
PID 3892 wrote to memory of 4196	3892	wmplayer.exe	78
PID 4196 wrote to memory of 4284	4196	unregmp2.exe	79
PID 4196 wrote to memory of 4284	4196	unregmp2.exe	79

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\download.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\download.mp4"
  2⤵
  PID:3756
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
bbb416e94d91b0dfbb49e250efb4e183

SHA1
bbf9700fd646ed2de62e7efc230b578e7cb5d414

SHA256
82302657180df4c8f2f81df34d3150f263b1a51773fc168b0b639906163d0dd5

SHA512
13d07ae391a9429f508a052aa7c6fa39fdc1d18963e2697f7918229dbebcaf937c65fa4209099178a9ca66e8ccb48544f24a073ca24837e65983f1517b054d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
520ea55152584a1e41d18c0c970097c1

SHA1
6cf5518d4d3d00aec0c4eb205441d2137a9f1bd6

SHA256
9711e72da3e284e33633f603625b7dbd6f361ca86bea0f383a4142054d4bec25

SHA512
29aff77bb905d3f4e91a6a41cd9d009689b578ca8ef761f1a6de5580acfd22c45c5c9ec0fe1779be1a12d819e8792c48d3fcaad59eeda8b735b47bce20c50482

Download Submit