e7de3a6f534de01b388d8258c1157d8771bbae17eb2a0320b995685d72e16f23

Resubmissions

30-03-2024 18:24

240330-w15prsbf31 10

Analysis

max time kernel
440s
max time network
1164s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
30-03-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virus.mp4
Size

926KB
MD5

55eaf87a0bbf92bcc275099fc840228a
SHA1

3d47d42f1b75ec610139d959bf40d79a85dc31b7
SHA256

e7de3a6f534de01b388d8258c1157d8771bbae17eb2a0320b995685d72e16f23
SHA512

9505fc66f2bc89163dae4e2b1163b62fc357d3382215cd00e830686005f4cca5eeedb45a4f8d1342272f5f98237e7d65a13b8d04b691dda60c1bfdfb35c276bb
SSDEEP

24576:Gf4u1oa524tXgiCb9ZqoPjVd/OMW78bcj:844HFe9ZqkjnWobw

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2964	unregmp2.exe
Token: SeCreatePagefilePrivilege	2964	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 5028	3320	wmplayer.exe	80
PID 3320 wrote to memory of 5028	3320	wmplayer.exe	80
PID 3320 wrote to memory of 5028	3320	wmplayer.exe	80
PID 3320 wrote to memory of 4452	3320	wmplayer.exe	81
PID 3320 wrote to memory of 4452	3320	wmplayer.exe	81
PID 3320 wrote to memory of 4452	3320	wmplayer.exe	81
PID 4452 wrote to memory of 2964	4452	unregmp2.exe	82
PID 4452 wrote to memory of 2964	4452	unregmp2.exe	82

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\virus.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\virus.mp4"
  2⤵
  PID:5028
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
3b4cbbf475f418be833505b137b75eff

SHA1
c3bd80cfafc3a23f86c6fd51e3f287fd901ecf54

SHA256
e9c66983b0bb0e6310dacc518909c25a67edb9392489d4a39212bb5b437b9404

SHA512
f009c98e811bef797993f78070cd2431ab7739929e2c8f55d6bd13bdf8bb9e3a78d7756f120cbcf58ae148120641cc44ef5056c941f3562a242f51e83669fba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
4211ad0dce93cd6cd45b610f12e04d8f

SHA1
4aa4d7b38161908af9e914f651983a078688955c

SHA256
82190d1a7dbf55e0f74233fe177306cf738bbf4e0f8d3dd82775cae267a7a323

SHA512
7a6b8904e213906c0e8724ff7316a0a4b04d01c15363e4941fa0e787ae738407dd3529ed132d3f9e71c914e3093210630287180c873c34da8dc5f66d1d5098bd

Download Submit