c95f37ac4a63b77b5a5a420ae603552cb71642c578488b784d10775f40be9d21

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
30/04/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SOUND24.wav
Size

11KB
MD5

fdb890581cb22703291f694c1f7895e0
SHA1

0483fcd451e86650720156eb821e6c09baadfa30
SHA256

501c4ad9d6a8600c3b206c5bbefe5fc0e27eb15cc3f14b767ae57c0bf04a0339
SHA512

fe0969cb9e50ab3ec2f7c3e865274592cfd3416c9073872b640a041f9938f27130df8635cf9031b70e7eac16c38c2d3da1370caffca66ad410e31ad9e6bf9684
SSDEEP

192:Bc8th01bmEmBq1xezOzMi7A1f8Ezo/Yuckt60v3uf3QT/umr0hq38mLhZ7UKqxQ3:Bc8IBmZByxxDgf8EU/YBO6M3ufQ38mLt

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2176	unregmp2.exe
Token: SeCreatePagefilePrivilege	2176	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 968	3044	wmplayer.exe	79
PID 3044 wrote to memory of 968	3044	wmplayer.exe	79
PID 3044 wrote to memory of 968	3044	wmplayer.exe	79
PID 3044 wrote to memory of 4132	3044	wmplayer.exe	81
PID 3044 wrote to memory of 4132	3044	wmplayer.exe	81
PID 3044 wrote to memory of 4132	3044	wmplayer.exe	81
PID 4132 wrote to memory of 2176	4132	unregmp2.exe	82
PID 4132 wrote to memory of 2176	4132	unregmp2.exe	82

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND24.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND24.wav"
  2⤵
  PID:968
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
bbb416e94d91b0dfbb49e250efb4e183

SHA1
bbf9700fd646ed2de62e7efc230b578e7cb5d414

SHA256
82302657180df4c8f2f81df34d3150f263b1a51773fc168b0b639906163d0dd5

SHA512
13d07ae391a9429f508a052aa7c6fa39fdc1d18963e2697f7918229dbebcaf937c65fa4209099178a9ca66e8ccb48544f24a073ca24837e65983f1517b054d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
3ddc76d9e1fb9200af936aa90430f12b

SHA1
f3307cb883eadd97523125e3a4fccf949a0ed9d3

SHA256
1188eaa0d2b85790d86e48609da10ca4b6a861fabee41d8db12308936a9394d0

SHA512
3192777b8e8b84b16d550078b63d9e74b25ac3dcae194e6fc2488305d15ffcfbbe8bb7314f51d64450039805457e054c3d6e236ecb6b5c4e4b70c5cdc7f893e0

Download Submit