8c2fb988b94fb4e30b0ecdcafd007e99b5a823957861663fb4f806c8ee8f884c

Analysis

max time kernel
455s
max time network
459s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/04/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KinitoPET-Python-Virtual-Assistant-main/GameAssets/Woosh.mp3
Size 16KB
Sample240402-ppdnkshg9s
SHA256 ba708905a9052e94a98ca1190fecb6582a165691e96a29965debd6321ddd15ec
MD5 8151a3d74d1cea10b3a6d4ab0be66613
SHA1 620ec1ae5b8fbafa3baecdb62aa174da02a3bba2
SHA512 5c5fa734bc2bd8aa72c7cc25e3d5c1ceab7a35a109c8e3fa77c7c48910ccfaf598bdb8952a638ed4f443c2223662ed585f5381af1131e830008644b7c909fbf1
SSDEEP 384:RcVWEynqBAnMuPw+QppPDg1v4+izVbQtgGl2g56t6:2VWjqSnFPdQppDgfizVctgGwgwt6
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4444	unregmp2.exe
Token: SeCreatePagefilePrivilege	4444	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4940	3632	wmplayer.exe	77
PID 3632 wrote to memory of 4940	3632	wmplayer.exe	77
PID 3632 wrote to memory of 4940	3632	wmplayer.exe	77
PID 3632 wrote to memory of 2596	3632	wmplayer.exe	78
PID 3632 wrote to memory of 2596	3632	wmplayer.exe	78
PID 3632 wrote to memory of 2596	3632	wmplayer.exe	78
PID 2596 wrote to memory of 4444	2596	unregmp2.exe	79
PID 2596 wrote to memory of 4444	2596	unregmp2.exe	79

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\GameAssets\Woosh.mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\GameAssets\Woosh.mp3"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 cac3a8354c7766b4ce0900bf4d8097bf372ec405a6af4bba63a6d92132932a30
MD5 066f6e5acfff197d12b550ef7d452d41
SHA1 aaa8cfa5a56519594490d069f31a42a15ca515a2
SHA512 21c3985bdc883b7c0fcdfb660a577eb03870943d9e812a24726158b6c06cc36b00425fdeafddcb099fddd1488173280563f7241c9589e69d04d1eb1b5daa786b
SSDEEP 3:xnallkltlsl7pl+e/lls4XtXMlOI1Xlldl0lcNklltlwzl4hR/mll:s+1E3+e9X9kOI10cAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 461b20d62d10b4ef8d98a3a5a0a9c5f829fd92bcc03f194e606272f8fe2205ca
MD5 33cba2fa718dbf6c055383dff69f9228
SHA1 fb3b0aacacf734438c84bf1b745dc9683e2f4c03
SHA512 11036eab62959842522c1629baef13f12648c1efa388a8175854bbe884d5a1206c0269411501acb5f67407720b53f91a26fd1b9b98fc7b814e21bbfd77f9dea6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads