c95f37ac4a63b77b5a5a420ae603552cb71642c578488b784d10775f40be9d21

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
30/04/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SOUND26.wav
Size

7KB
MD5

efe11fc59caab2e86a9f66294037989e
SHA1

b00cfb19c98c42e9cc5efde516a6cf67d5271f19
SHA256

1a6fbd0dd59a2a1b60617d6359ba2270e55b0b6b806b16b3997d902edb342091
SHA512

c9b37368e367e49421362ce62e93e528f3438874aa59061bde9a0a6338e46004ac3a48a810429fdf35cefb1e1b8dcb445a9f021ed2d7ffd4913013b8d2414df7
SSDEEP

192:gppghRTqoAMcGfyUiEXuGh7z5YBKmliXcHRwtbl:o6qB+fy2+GhHOUmIcHRQbl

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4772	unregmp2.exe
Token: SeCreatePagefilePrivilege	4772	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4676	3552	wmplayer.exe	77
PID 3552 wrote to memory of 4676	3552	wmplayer.exe	77
PID 3552 wrote to memory of 4676	3552	wmplayer.exe	77
PID 3552 wrote to memory of 2804	3552	wmplayer.exe	78
PID 3552 wrote to memory of 2804	3552	wmplayer.exe	78
PID 3552 wrote to memory of 2804	3552	wmplayer.exe	78
PID 2804 wrote to memory of 4772	2804	unregmp2.exe	79
PID 2804 wrote to memory of 4772	2804	unregmp2.exe	79

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND26.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND26.wav"
  2⤵
  PID:4676
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
4d168bb234c12d677dc5fca064e443fa

SHA1
f620a25e9168b2e0bbef491ecb1106adb03e6425

SHA256
dbd451ecaaefead3a5a663bba2189d69c5cf0999236d5a31ff26e83f5bb3fd60

SHA512
fc03a14dd50892a7b0cc85ab2aede88b0243937aa535bd384e34c890203e685448f364d256868b9c1b1c82fe34738096e907726e44ec9a6fc50d825b9c3898ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
f24d4b3e8de0ee90083790b4def6632e

SHA1
82f339b2bd1ec91990a13ab93016f0219a57386d

SHA256
6612581fe2d21a599abc8ea2444cc5f17c924f0c0cc13b927b19aecb126dda45

SHA512
8777f574e99eb3e8308ca525551743cbc56198258bebacd5c8e6dbf8b4a4410b222d4a07da073b318f3d324608b93aec1fc37851b6f3c5b1e0ce416889a4950d

Download Submit