8c2fb988b94fb4e30b0ecdcafd007e99b5a823957861663fb4f806c8ee8f884c

Analysis

max time kernel
451s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
02/04/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KinitoPET-Python-Virtual-Assistant-main/GameAssets/NewBeginningsPoemEdit.mp3
Size 642KB
Sample240402-ppdnkshg9s
SHA256 c3ba0be555dc858856700997715ba87032ee68f887f25d44da6178ae47282d45
MD5 526aaccca36b7ab8b6017e871bee3c79
SHA1 229be665c39321a174cf9e31ccdda17ffc710ca1
SHA512 f8d15fc5b09d94f0b61f3f639a41e67398a433e6955995945820ef22be4e872b2e89712d3445a8dd9fc304d9b4d8a520ea1bc32ea08ad91f723769c87cdccfba
SSDEEP 12288:FknmzOLHIrRacaJaD8e5gRJPU/8zGdz5CxbM55kVfCrXiOM54rnEp8QF+DbE:F2mzOLorRacaJq55YsEzGd9AQifCrhtk
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	244	unregmp2.exe
Token: SeCreatePagefilePrivilege	244	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3608	4044	wmplayer.exe	76
PID 4044 wrote to memory of 3608	4044	wmplayer.exe	76
PID 4044 wrote to memory of 3608	4044	wmplayer.exe	76
PID 4044 wrote to memory of 3224	4044	wmplayer.exe	77
PID 4044 wrote to memory of 3224	4044	wmplayer.exe	77
PID 4044 wrote to memory of 3224	4044	wmplayer.exe	77
PID 3224 wrote to memory of 244	3224	unregmp2.exe	78
PID 3224 wrote to memory of 244	3224	unregmp2.exe	78

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\GameAssets\NewBeginningsPoemEdit.mp3"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\KinitoPET-Python-Virtual-Assistant-main\GameAssets\NewBeginningsPoemEdit.mp3"
  2⤵
  PID:3608
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 4a08dbe24c5c0620f4a4cb2be0f1b07287718181f6b63c162e264860e4950e6a
MD5 787a5dbdd014510ba67f4ca991825300
SHA1 2e7e0fa0249b68a420f4f9a4a1cda637d1a154f2
SHA512 23a816f6c01ba1a067f43fc0be846237442b05f5c8054e4dd07eee7aac61f2652d6ba6c6494bfc44b028014c234dc76b1b3575767a585cb4318f2f2ab48e2039
SSDEEP 6:0Q+1E3+e9X9ksBB2DsUIAssMNOKVgYrpDvsgZ+bUr/OI10cAe:0R1E3+e9X9kTDlIAssSOKVgCDvwbg30
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 ffa67b5069740c567b05d4db2f049b54377e2adf1816779f3d163450ade1503a
MD5 03c333a5eae87ed1cd91f74340ad50f9
SHA1 e01740e75cdb05db860d46deb06b16163ad9831b
SHA512 bc50434d603d9f86000ad3f6ff1cad0329f14b79ac0f984f5b5131851ae6b7a2a8f6b1658db8c390d8b29a5314e7d7e103419cf90abd9c3c7cff29818b53b9a9
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads