0ae587f12695ccafab2f0328dffa444e6208ecad24e8840a5928911e5414ab36

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Walecz Ghost 0.50/G3032.wav
Size

23KB
MD5

90ca6ca8827672d9744dfa7a0c41b5d1
SHA1

bee1440cc804e2bdd9a898889f9a2cb8259d24d3
SHA256

015081ea6cfb3828c82bb384cb49013db6c80f1dedcbfbc97f0eb966367e20e1
SHA512

b73caff2f8c1302712f69d2f81923fb212907458c344efa8b93cc31fb1cbef432fd056924c6461cc92a40da90fb1cb507c9300a11966e2c6859ba65e01bcfa53
SSDEEP

192:qiTnX3we83SfnD/HRz9vphXfF9PL7jPPevAP5taFRQn:qPeffevAPTi8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4172	unregmp2.exe
Token: SeCreatePagefilePrivilege	4172	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 4160	3612	wmplayer.exe	82
PID 3612 wrote to memory of 4160	3612	wmplayer.exe	82
PID 3612 wrote to memory of 4160	3612	wmplayer.exe	82
PID 3612 wrote to memory of 4484	3612	wmplayer.exe	83
PID 3612 wrote to memory of 4484	3612	wmplayer.exe	83
PID 3612 wrote to memory of 4484	3612	wmplayer.exe	83
PID 4484 wrote to memory of 4172	4484	unregmp2.exe	84
PID 4484 wrote to memory of 4172	4484	unregmp2.exe	84

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Walecz Ghost 0.50\G3032.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Walecz Ghost 0.50\G3032.wav"
  2⤵
  PID:4160
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
c374c25875887db7d072033f817b6ce1

SHA1
3a6d10268f30e42f973dadf044dba7497e05cdaf

SHA256
05d47b87b577841cc40db176ea634ec49b0b97066e192e1d48d84bb977e696b6

SHA512
6a14f81a300695c09cb335c13155144e562c86bb0ddfdcab641eb3a168877ad3fcc0579ad86162622998928378ea2ffe5a244b3ddbe6c11a959dbb34af374a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
17727915190a7519b6d6e3678390e55c

SHA1
8153dfe4b35932cdf437bc6103a557f22fa87aae

SHA256
5679f8d9e21e2c911661c9477ed7f0e6b06a4dc7e433d0832855909a6e4bb37d

SHA512
04e19d6419a9cdff05689520bcd70607ac89497b35070548c3b7c1308ff7a055864483a7ccf86b90ff59cc713605cd7cb75aafbde11b6e8321dbc633f46ea1c4

Download Submit