Overview
overview
6Static
static
3PinballXP.zip
windows11-21h2-x64
1FONT.dat
windows11-21h2-x64
3PINBALL.dat
windows11-21h2-x64
3PINBALL.mid
windows11-21h2-x64
1PINBALL2.mid
windows11-21h2-x64
1SOUND1.wav
windows11-21h2-x64
6SOUND104.wav
windows11-21h2-x64
6SOUND105.wav
windows11-21h2-x64
6SOUND108.wav
windows11-21h2-x64
6SOUND111.wav
windows11-21h2-x64
6SOUND112.wav
windows11-21h2-x64
6SOUND12.wav
windows11-21h2-x64
1SOUND13.wav
windows11-21h2-x64
6SOUND131.wav
windows11-21h2-x64
6SOUND136.wav
windows11-21h2-x64
6SOUND14.wav
windows11-21h2-x64
6SOUND16.wav
windows11-21h2-x64
6SOUND17.wav
windows11-21h2-x64
6SOUND18.wav
windows11-21h2-x64
1SOUND181.wav
windows11-21h2-x64
6SOUND19.wav
windows11-21h2-x64
6SOUND20.wav
windows11-21h2-x64
6SOUND21.wav
windows11-21h2-x64
6SOUND22.wav
windows11-21h2-x64
6SOUND24.wav
windows11-21h2-x64
6SOUND240.wav
windows11-21h2-x64
6SOUND243.wav
windows11-21h2-x64
6SOUND25.wav
windows11-21h2-x64
6SOUND26.wav
windows11-21h2-x64
6SOUND27.wav
windows11-21h2-x64
1SOUND28.wav
windows11-21h2-x64
6SOUND29.wav
windows11-21h2-x64
6Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-04-2024 07:34
Static task
static1
Behavioral task
behavioral1
Sample
PinballXP.zip
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
FONT.dat
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
PINBALL.dat
Resource
win11-20240419-en
Behavioral task
behavioral4
Sample
PINBALL.mid
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
PINBALL2.mid
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
SOUND1.wav
Resource
win11-20240419-en
Behavioral task
behavioral7
Sample
SOUND104.wav
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
SOUND105.wav
Resource
win11-20240419-en
Behavioral task
behavioral9
Sample
SOUND108.wav
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
SOUND111.wav
Resource
win11-20240419-en
Behavioral task
behavioral11
Sample
SOUND112.wav
Resource
win11-20240426-en
Behavioral task
behavioral12
Sample
SOUND12.wav
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
SOUND13.wav
Resource
win11-20240426-en
Behavioral task
behavioral14
Sample
SOUND131.wav
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
SOUND136.wav
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
SOUND14.wav
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
SOUND16.wav
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
SOUND17.wav
Resource
win11-20240419-en
Behavioral task
behavioral19
Sample
SOUND18.wav
Resource
win11-20240426-en
Behavioral task
behavioral20
Sample
SOUND181.wav
Resource
win11-20240419-en
Behavioral task
behavioral21
Sample
SOUND19.wav
Resource
win11-20240419-en
Behavioral task
behavioral22
Sample
SOUND20.wav
Resource
win11-20240419-en
Behavioral task
behavioral23
Sample
SOUND21.wav
Resource
win11-20240419-en
Behavioral task
behavioral24
Sample
SOUND22.wav
Resource
win11-20240419-en
Behavioral task
behavioral25
Sample
SOUND24.wav
Resource
win11-20240426-en
Behavioral task
behavioral26
Sample
SOUND240.wav
Resource
win11-20240419-en
Behavioral task
behavioral27
Sample
SOUND243.wav
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
SOUND25.wav
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
SOUND26.wav
Resource
win11-20240426-en
Behavioral task
behavioral30
Sample
SOUND27.wav
Resource
win11-20240426-en
Behavioral task
behavioral31
Sample
SOUND28.wav
Resource
win11-20240419-en
Behavioral task
behavioral32
Sample
SOUND29.wav
Resource
win11-20240419-en
General
-
Target
SOUND112.wav
-
Size
824B
-
MD5
e6ce1719e5a7118d9e69f1c92fb1939e
-
SHA1
5991dabb2969f149ad4b5fdea2784e9f69ae6ca2
-
SHA256
0ebb658081295dd5421fbcb9d8418786bf0566a0393e1dc78a0cf82205bb0af3
-
SHA512
36491ea5ba94cb28668ba6f12ecd2cc90e4df8a2eca4b0798063d1672116f2bf505153bf7a63408e2ab67ab10aaa06b0732b8c47f6783e914f4bea4c8abccccf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4500 unregmp2.exe Token: SeCreatePagefilePrivilege 4500 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1616 wrote to memory of 3616 1616 wmplayer.exe 80 PID 1616 wrote to memory of 3616 1616 wmplayer.exe 80 PID 1616 wrote to memory of 3616 1616 wmplayer.exe 80 PID 1616 wrote to memory of 3824 1616 wmplayer.exe 81 PID 1616 wrote to memory of 3824 1616 wmplayer.exe 81 PID 1616 wrote to memory of 3824 1616 wmplayer.exe 81 PID 3824 wrote to memory of 4500 3824 unregmp2.exe 82 PID 3824 wrote to memory of 4500 3824 unregmp2.exe 82
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND112.wav"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND112.wav"2⤵PID:3616
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5d35defde3ad3faecd5955399986c9785
SHA17762067bc38abb0654f552bd5967404c57954ea3
SHA25669d351f5546d8e20aed4549148ce8b8344faa65fb64e00b248028ac408922319
SHA512cabff3a74b4b18b87b389f74c383dd79f33f17504a239deb35bb0ccf0d6f9e20b638d136ef8b3b7390f48a16e4f9398f264cc714766c8f7c032124a8737d84d0
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD5f24d4b3e8de0ee90083790b4def6632e
SHA182f339b2bd1ec91990a13ab93016f0219a57386d
SHA2566612581fe2d21a599abc8ea2444cc5f17c924f0c0cc13b927b19aecb126dda45
SHA5128777f574e99eb3e8308ca525551743cbc56198258bebacd5c8e6dbf8b4a4410b222d4a07da073b318f3d324608b93aec1fc37851b6f3c5b1e0ce416889a4950d