8c2fb988b94fb4e30b0ecdcafd007e99b5a823957861663fb4f806c8ee8f884c

Analysis

max time kernel
452s
max time network
454s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/04/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KinitoPET-Python-Virtual-Assistant-main/GameAssets/Timer.mp3
Size 69KB
Sample240402-ppdnkshg9s
SHA256 cc94cd99b9ddbb564d01123c6f6d68c207a41cfe5d08268bdce6a2586c0de63a
MD5 85a8cac81347bd07a5379e1c18e4f074
SHA1 ebf4c0ec805b41a0ba0aa163e4bd698ee9cb1d3b
SHA512 665925b4655016a4321778fb818d88028c7f860dde73ce953b913fa2e41c373474af5d32e9b981a3c1dd20ab7c2d6a21110483b1f9c6276ad65a5fc463f991c0
SSDEEP 1536:1cO6WnU4DI75p4BeFBy/oSJj91xn2CPiWTM4m1zKZraGTz:6O6WU4Dq68Fi7JV2cd+zuf
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3984	unregmp2.exe
Token: SeCreatePagefilePrivilege	3984	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3436	780	wmplayer.exe	77
PID 780 wrote to memory of 3436	780	wmplayer.exe	77
PID 780 wrote to memory of 3436	780	wmplayer.exe	77
PID 780 wrote to memory of 1596	780	wmplayer.exe	78
PID 780 wrote to memory of 1596	780	wmplayer.exe	78
PID 780 wrote to memory of 1596	780	wmplayer.exe	78
PID 1596 wrote to memory of 3984	1596	unregmp2.exe	79
PID 1596 wrote to memory of 3984	1596	unregmp2.exe	79

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\GameAssets\Timer.mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\GameAssets\Timer.mp3"
  2⤵
  PID:3436
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 cac3a8354c7766b4ce0900bf4d8097bf372ec405a6af4bba63a6d92132932a30
MD5 066f6e5acfff197d12b550ef7d452d41
SHA1 aaa8cfa5a56519594490d069f31a42a15ca515a2
SHA512 21c3985bdc883b7c0fcdfb660a577eb03870943d9e812a24726158b6c06cc36b00425fdeafddcb099fddd1488173280563f7241c9589e69d04d1eb1b5daa786b
SSDEEP 3:xnallkltlsl7pl+e/lls4XtXMlOI1Xlldl0lcNklltlwzl4hR/mll:s+1E3+e9X9kOI10cAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 c2235fdc0a8f2ff7128eda68c051d52fc1995e356ad01f1452671b4c71ad5e5b
MD5 359c6432c51a34dfb605d55f23bc9759
SHA1 5cd3a7112436a5b8efd6764ed411b14fc7c4bd95
SHA512 cceefddb7dd7e36430ead52fc490d323c9d3e71f6eff6bf610e7157b41fef7508f255389d766b6cf330edfe385605c228b34f61c264797503986dce691005386
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads