c95f37ac4a63b77b5a5a420ae603552cb71642c578488b784d10775f40be9d21

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
30/04/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SOUND108.wav
Size

7KB
MD5

1f5212291303abc61e31dd5460b502d2
SHA1

362823fcf19b32d4488eb943833eeb6846732f6f
SHA256

b5c15daa4ddb807c193fdd3c52e8d0a14afdbcaf51a6e7bafa999f76df027d76
SHA512

9933298d3277d4312720f03f3e7de84376c854977db5e461c47df5a434e8407f594df1bf79aded926accf55272d67ab701e38b1c569b4a219adc9777167a1e31
SSDEEP

192:yOlbbXHK24iUYSt6pcuEV7Bdqu5oV9k56nG1guuTFy:yibbXHK24iYg4uu5ojk56nG1g4

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2496	unregmp2.exe
Token: SeCreatePagefilePrivilege	2496	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3272	4288	wmplayer.exe	80
PID 4288 wrote to memory of 3272	4288	wmplayer.exe	80
PID 4288 wrote to memory of 3272	4288	wmplayer.exe	80
PID 4288 wrote to memory of 3748	4288	wmplayer.exe	81
PID 4288 wrote to memory of 3748	4288	wmplayer.exe	81
PID 4288 wrote to memory of 3748	4288	wmplayer.exe	81
PID 3748 wrote to memory of 2496	3748	unregmp2.exe	82
PID 3748 wrote to memory of 2496	3748	unregmp2.exe	82

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND108.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\SOUND108.wav"
  2⤵
  PID:3272
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
bbb416e94d91b0dfbb49e250efb4e183

SHA1
bbf9700fd646ed2de62e7efc230b578e7cb5d414

SHA256
82302657180df4c8f2f81df34d3150f263b1a51773fc168b0b639906163d0dd5

SHA512
13d07ae391a9429f508a052aa7c6fa39fdc1d18963e2697f7918229dbebcaf937c65fa4209099178a9ca66e8ccb48544f24a073ca24837e65983f1517b054d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
aa1f61876d297445456a8b072ef892ae

SHA1
8cb150b42451690c260d791ae17612e1aacd9fe8

SHA256
1639283d56b97566e6ff58034aebfa69332c3c4a44ae24f215153446890b7867

SHA512
ff1b8ce29799d1c85d44005eef3cedadc7efc1ad47ad94b4c70638095dab85c87479b0ca014c6c7a938872540c0cafd40e38a006aa81066604eda246e1e70687

Download Submit