9d38f89adecd2d85b288ef859f8b8a886903635ec6cb889d959ced046fb385a4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kjh37fyB3v.exe
Size 3.1MB
Sample240423-ph5hqagb85
SHA256 9d38f89adecd2d85b288ef859f8b8a886903635ec6cb889d959ced046fb385a4
MD5 86f1422d53e3408b02fbd1d55310d19f
SHA1 1f9c6b182c9048aba03b61a048bc9aabf33aaabd
SHA512 c89a518aef073a83c3e59b094472a7cb6baf3a890693ca01d31a69eb42e7b8a548ab5adad2030eda20e4bf3acae3bb6b62d0f112875dfa1ec9d16445ea0bdb40
SSDEEP 98304:1qMvRG2lkvJsIaL8E9JuTm740VZDIwh7two8kQ9:15gpvJsIaLTJ2m7xFhRwoI9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

agilenet persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	kjh37fyB3v.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/3668-6-0x0000028B7AEB0000-0x0000028B7B232000-memory.dmp	agile_net
behavioral2/files/0x000300000001e97c-9.dat	agile_net

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs

pid	Process
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1152	WINWORD.EXE
1152	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe
3668	kjh37fyB3v.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	kjh37fyB3v.exe
Token: SeShutdownPrivilege	2284	unregmp2.exe
Token: SeCreatePagefilePrivilege	2284	unregmp2.exe
Token: SeShutdownPrivilege	1972	wmplayer.exe
Token: SeCreatePagefilePrivilege	1972	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	wmplayer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1152	WINWORD.EXE
1152	WINWORD.EXE
1152	WINWORD.EXE
1152	WINWORD.EXE
1152	WINWORD.EXE
1152	WINWORD.EXE
1152	WINWORD.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 624	3668	kjh37fyB3v.exe	101
PID 3668 wrote to memory of 624	3668	kjh37fyB3v.exe	101
PID 624 wrote to memory of 3128	624	cmd.exe	103
PID 624 wrote to memory of 3128	624	cmd.exe	103
PID 4564 wrote to memory of 2456	4564	wmplayer.exe	115
PID 4564 wrote to memory of 2456	4564	wmplayer.exe	115
PID 4564 wrote to memory of 2456	4564	wmplayer.exe	115
PID 4564 wrote to memory of 1956	4564	wmplayer.exe	116
PID 4564 wrote to memory of 1956	4564	wmplayer.exe	116
PID 4564 wrote to memory of 1956	4564	wmplayer.exe	116
PID 1956 wrote to memory of 2284	1956	unregmp2.exe	117
PID 1956 wrote to memory of 2284	1956	unregmp2.exe	117
PID 2456 wrote to memory of 4520	2456	setup_wm.exe	119
PID 2456 wrote to memory of 4520	2456	setup_wm.exe	119
PID 2456 wrote to memory of 4520	2456	setup_wm.exe	119
PID 4520 wrote to memory of 4640	4520	unregmp2.exe	120
PID 4520 wrote to memory of 4640	4520	unregmp2.exe	120
PID 2456 wrote to memory of 1972	2456	setup_wm.exe	122
PID 2456 wrote to memory of 1972	2456	setup_wm.exe	122
PID 2456 wrote to memory of 1972	2456	setup_wm.exe	122

C:\Users\Admin\AppData\Local\Temp\kjh37fyB3v.exe
"C:\Users\Admin\AppData\Local\Temp\kjh37fyB3v.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\5F3A6525.dll" /A:H
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:3128

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Recently.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1152

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Recently.docx" /o ""
1⤵
PID:1128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:4640
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\UnregisterImport.mp2
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1972
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 63eeb56ae92bc51c168ff0bbe61e7c0f1dc1692532885be0e642e00949022cf6
MD5 207bc871c010b549099fe6c9aac34053
SHA1 3780e26391ac5dbec97379701b50b18655dd1450
SHA512 2840b06e0b279c694dcee240733b73e4fe6bc3575e5fed409c2d1fd03cf0ae0090db0433f2c1402834d6e2345ab4174d663e60db3a6c215345268e415d8b696d
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba9:rZP2tFP3vqY89qEMBTaBacgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

5F3A6525.dll

Path C:\Users\Admin\AppData\Local\Temp\5F3A6525.dll
Size 1.7MB
SHA256 39fdb1db9c56133e62c9635043a403a0cbc77bc97ef3e776b258e2ea2e19cd13
MD5 cad4e5bb24e842532cb2d2c0ac02cff0
SHA1 d2f6d0055141774d1a1cfc2140aafb9e5243b681
SHA512 77c1b2b6724fec3cb912a6f1d827f8ac9669a26486a48c24ee7029dac36ff026979be7727a6328ca1af7ba34d0f3c314320296320ffdd57ac8332a6b1d7c2999
SSDEEP 49152:F/GolQdJ1AxAdJ4rjPxoYi3w9TTrV3CN8qwsMf3mj:F/GolOJ1Am2vOOV3CN7FMOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 898a98bc4d231fdb76882335d7acee35efff6f28b999b905c66de3dc33cfcf4e
MD5 b75b45ac8b7ea21fd2369f3a771d9bde
SHA1 5cd9f55b361c2d765c97f0e501d9b1bb39cbfc29
SHA512 775fa2540b1fcf88b3b0b69040dc445da75a50d699e43a73970d52b5c545bb377a28ba1d1b98dd722032082bda032a16855754e1a7a389ac738567bbd9b7fa99
MD5 SHA1 SHA512

Submit Download

memory/1128-47-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1128-44-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1128-48-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1128-49-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1128-53-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1128-52-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1128-51-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1128-50-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1128-46-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1128-45-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-21-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-55-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-25-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1152-24-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-27-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-33-0x00007FFD62C50000-0x00007FFD62C60000-memory.dmp

Download

memory/1152-30-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-32-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-34-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-36-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-29-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-37-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-38-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-42-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-40-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-43-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-39-0x00007FFD62C50000-0x00007FFD62C60000-memory.dmp

Download

memory/1152-22-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1152-20-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1152-19-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-18-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1152-17-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1152-16-0x00007FFD654B0000-0x00007FFD654C0000-memory.dmp

Download

memory/1152-99-0x00007FFDA5430000-0x00007FFDA5625000-memory.dmp

Download

memory/1972-143-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-149-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-158-0x0000000009370000-0x0000000009380000-memory.dmp

Download

memory/1972-154-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-153-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-152-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-151-0x0000000009370000-0x0000000009380000-memory.dmp

Download

memory/1972-150-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-141-0x0000000004450000-0x0000000004460000-memory.dmp

Download

memory/1972-142-0x0000000004450000-0x0000000004460000-memory.dmp

Download

memory/1972-148-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-144-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-145-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-147-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/1972-146-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/3668-0-0x0000028B60010000-0x0000028B60338000-memory.dmp

Download

memory/3668-11-0x0000028B7A930000-0x0000028B7A942000-memory.dmp

Download

memory/3668-4-0x0000028B7A920000-0x0000028B7A930000-memory.dmp

Download

memory/3668-6-0x0000028B7AEB0000-0x0000028B7B232000-memory.dmp

Download

memory/3668-8-0x0000028B60700000-0x0000028B60701000-memory.dmp

Download

memory/3668-14-0x00007FFD871B0000-0x00007FFD87C71000-memory.dmp

Download

memory/3668-12-0x00007FFD871B0000-0x00007FFD87C71000-memory.dmp

Download

memory/3668-3-0x00007FFD871B0000-0x00007FFD87C71000-memory.dmp

Download

memory/3668-10-0x0000028B606F0000-0x0000028B606F6000-memory.dmp

Download