c95f37ac4a63b77b5a5a420ae603552cb71642c578488b784d10775f40be9d21

Analysis

max time kernel
44s
max time network
54s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
30/04/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SOUND19.wav
Size

5KB
MD5

c2aedaf860ec7afc8701473e1e399a71
SHA1

a784be434f01c4f36fc3facad9285b67801f92c4
SHA256

297892c4fc6a854675e2243863a7b3f9be9b7ba17cfdf6932deeb6e5a9b78977
SHA512

7ad2f1a19dffdcbe927a329b1a442721b6c037dfe01d90a56de633823d33431109806957973e93213dcc9ecc752f1c6ca8d68a7f7fd593b007f43579ab51266d
SSDEEP

96:sfwfya2k0wqG+2bnJm1+EFSar7/NfW/YiZrqEJcXfziTkMhBYaHBw3IvZG2s:sW2HsJmNFS0x3uq4cXf/MhBtCAE

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	388	unregmp2.exe
Token: SeCreatePagefilePrivilege	388	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4272	2740	wmplayer.exe	80
PID 2740 wrote to memory of 4272	2740	wmplayer.exe	80
PID 2740 wrote to memory of 4272	2740	wmplayer.exe	80
PID 2740 wrote to memory of 2752	2740	wmplayer.exe	81
PID 2740 wrote to memory of 2752	2740	wmplayer.exe	81
PID 2740 wrote to memory of 2752	2740	wmplayer.exe	81
PID 2752 wrote to memory of 388	2752	unregmp2.exe	82
PID 2752 wrote to memory of 388	2752	unregmp2.exe	82

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND19.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND19.wav"
  2⤵
  PID:4272
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
7229b481967197e1f848dfaee07fb7e5

SHA1
df091f7998f9e45c2e516a278c601423b75147b2

SHA256
f99282e05598337335fc8e4cc445be34ed1ab49544f2dc593e8af66cfe1a88ef

SHA512
28d6b076c3e9fea0d12fb66adc68343d2e1e75c43ba5b2bb7c9b409483aa79b10bd5540507a999cdb0843aaad7007fede9fdaf8b79eb13c515393ab40398e3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
58328740f939ef9fbc2f881110158ada

SHA1
bbb8f42d4646bf1e40ca69dc7559dd21d91b58b9

SHA256
17d7b7fc930c8da0dd69d11545ceccca2896ddc7a944f66576c3be03d75d2320

SHA512
59aff495a1ebc821f5221eb9bdbe9d8c75580db769694d0169e8796e92e213bce765a0d8121fd11eed1df4602516bc57d744942dfb9e427d3b49cff93ec095b1

Download Submit