981eeb419fd3ac1a7701cebe39149c89c8ba22a389936e93b3984d9640fdfad8

Analysis

max time kernel
144s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

art/sound/engine/0BE1F1A5405C187702AEE893B40ABF5F/EXH_1052.wav
Size

189KB
MD5

f44c1ffb1444bfa34e58f06accc57be8
SHA1

a2dda4e406403817b5d0cf526e3757ad7bf4e993
SHA256

4f883ad44665032ad698527be0a1a8ee9a37428a22af2fdc4458511ccbef0853
SHA512

db865a2d4f1a5b1f51058f4c0ecb2d521d9cece3e79efac5a06cc2dab16fa1b9b843213379b164d95a25be90d29cb1bf937a399219829001961b4467e2e8891d
SSDEEP

768:scukXWVkealWOkvpb9COYg7/ivETi1xkqHiEkdqV2dImUMNH4KtP+hSBILXOsMU5:s9mW9vTLNexBxjU4JhSmXOEHMzo

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4792	unregmp2.exe
Token: SeCreatePagefilePrivilege	4792	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 3236	4024	wmplayer.exe	86
PID 4024 wrote to memory of 3236	4024	wmplayer.exe	86
PID 4024 wrote to memory of 3236	4024	wmplayer.exe	86
PID 4024 wrote to memory of 3612	4024	wmplayer.exe	87
PID 4024 wrote to memory of 3612	4024	wmplayer.exe	87
PID 4024 wrote to memory of 3612	4024	wmplayer.exe	87
PID 3612 wrote to memory of 4792	3612	unregmp2.exe	88
PID 3612 wrote to memory of 4792	3612	unregmp2.exe	88

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\0BE1F1A5405C187702AEE893B40ABF5F\EXH_1052.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\art\sound\engine\0BE1F1A5405C187702AEE893B40ABF5F\EXH_1052.wav"
  2⤵
  PID:3236
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
dd4e71780b66dd0a92b7bd5eaf0f187f

SHA1
185e36b8cd845e0ebf66fc8c1be542b295e12214

SHA256
a1da10a8344a35f1fbca23a956fbd0ad5ca4eb3f4abd8b0bbfff1f74ad0e65be

SHA512
a118c7cd2ec0dec05ae802f843972955a3182db2c019e45c8217d0f26c71ac977355e29ad29f6fd23f94e0463b71256839274dfd2301647f1d0c9fb42d282884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
12f4034b3008418fa79e6683571fcd8b

SHA1
63a5fbf4ed7eef3318b497a6cfbfbff89413ec3c

SHA256
016ffc8a72a4e66b861f4c0b90cedd0856605bf7c798e494feff60caf38fc252

SHA512
43e2d4d332425c9a4e57b46f3463d9420acc4fafe1195327a8c104337bd7fc7f4982d03ee60566218c360acb9784d86effa12483222105cfd923ac81b106fe66

Download Submit