Overview
overview
10Static
static
7SpySheriff.zip
windows7-x64
1SpySheriff.zip
windows10-2004-x64
1IESecurity.dll
windows7-x64
6IESecurity.dll
windows10-2004-x64
6ProcMon.dll
windows7-x64
1ProcMon.dll
windows10-2004-x64
1ReadME.txt
windows7-x64
1ReadME.txt
windows10-2004-x64
1SpySheriff.dvm
windows7-x64
3SpySheriff.dvm
windows10-2004-x64
3SpySheriff.exe
windows7-x64
7SpySheriff.exe
windows10-2004-x64
7Uninstall.exe
windows7-x64
1Uninstall.exe
windows10-2004-x64
1base.avd
windows7-x64
3base.avd
windows10-2004-x64
3base001.avd
windows7-x64
3base001.avd
windows10-2004-x64
3base002.avd
windows7-x64
3base002.avd
windows10-2004-x64
3found.wav
windows7-x64
1found.wav
windows10-2004-x64
6heur000.dll
windows7-x64
1heur000.dll
windows10-2004-x64
1heur001.dll
windows7-x64
1heur001.dll
windows10-2004-x64
1heur002.dll
windows7-x64
4heur002.dll
windows10-2004-x64
4heur003.dll
windows7-x64
10heur003.dll
windows10-2004-x64
10notfound.wav
windows7-x64
1notfound.wav
windows10-2004-x64
6Analysis
-
max time kernel
132s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 20:20
Behavioral task
behavioral1
Sample
SpySheriff.zip
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SpySheriff.zip
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
IESecurity.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
IESecurity.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
ProcMon.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
ProcMon.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
ReadME.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ReadME.txt
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
SpySheriff.dvm
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
SpySheriff.dvm
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
SpySheriff.exe
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
SpySheriff.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
base.avd
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
base.avd
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
base001.avd
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
base001.avd
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
base002.avd
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
base002.avd
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
found.wav
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
found.wav
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
heur000.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
heur000.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
heur001.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
heur001.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
heur002.dll
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
heur002.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
heur003.dll
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
heur003.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
notfound.wav
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
notfound.wav
Resource
win10v2004-20240426-en
General
-
Target
notfound.wav
-
Size
20KB
-
MD5
b6db2d81423853ca8e82bd42e04e9ab2
-
SHA1
cfe0832bd5b107c94a54dc3c64df930462955dcf
-
SHA256
05c118e5a69fb0603c4e4d6357d3b92e3aca6e93883955eb9ec08110edc65fd5
-
SHA512
56ab7ad06fa0e55f44674279e9957cb96b13b090c0a61dd613c062654c37da2bff3dcf4a7d765db313de7fa19bb859794d3c06dfdadca23e45acf7c5c5fa6c19
-
SSDEEP
384:fWkYjsRliyvEwE5KDNYRcxHw6m6PV7WnG2q5FN2Kli+C:fuj04yvEwEM6Rcxjt4Bm0
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unregmp2.exedescription pid process Token: SeShutdownPrivilege 4900 unregmp2.exe Token: SeCreatePagefilePrivilege 4900 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wmplayer.exeunregmp2.exedescription pid process target process PID 3080 wrote to memory of 2380 3080 wmplayer.exe setup_wm.exe PID 3080 wrote to memory of 2380 3080 wmplayer.exe setup_wm.exe PID 3080 wrote to memory of 2380 3080 wmplayer.exe setup_wm.exe PID 3080 wrote to memory of 4632 3080 wmplayer.exe unregmp2.exe PID 3080 wrote to memory of 4632 3080 wmplayer.exe unregmp2.exe PID 3080 wrote to memory of 4632 3080 wmplayer.exe unregmp2.exe PID 4632 wrote to memory of 4900 4632 unregmp2.exe unregmp2.exe PID 4632 wrote to memory of 4900 4632 unregmp2.exe unregmp2.exe
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\notfound.wav"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\notfound.wav"2⤵
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
256KB
MD5563088ad0f20fabf9dd62c6ba8ae1636
SHA1f9cd2fd153afa1a12ff990cf27c32b8c9c44e878
SHA256eb897bf202d32f067728f1b666eb16e9926557efa8676b72db11411013030184
SHA5128229dfb1d96b6a34b91b1e5c463833e7859331be880f585c48af1ba0ace0465ac755c7f22a9e6f30284266165f850e8f85af76157eea8136b2d6f79db02d3092
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD5aedbc31504c01d8200b619ca711b6e9d
SHA15528aefa3493c74855b1a4160c8b7bcb08257d7b
SHA25663f039f13c589b40281aa826ba12c930a36de6d6377cbcb35d2147ebdd697539
SHA5123e680b5da6bee4ec99b31abb1d712e1b8fb102b045538223575b75b246cd538469d2e7a35d1928f5036d7e0a8deca3d55f5ba62f95340576590616f5351337bf