Overview
overview
7Static
static
7KakaoTalk_Setup.exe
windows7-x64
3KakaoTalk_Setup.exe
windows10-2004-x64
7resource/s...01.mp3
windows7-x64
1resource/s...01.mp3
windows10-2004-x64
6resource/s...02.mp3
windows7-x64
1resource/s...02.mp3
windows10-2004-x64
6resource/s...03.mp3
windows7-x64
1resource/s...03.mp3
windows10-2004-x64
6resource/s...04.mp3
windows7-x64
1resource/s...04.mp3
windows10-2004-x64
6resource/s...05.mp3
windows7-x64
1resource/s...05.mp3
windows10-2004-x64
6resource/s...06.mp3
windows7-x64
1resource/s...06.mp3
windows10-2004-x64
6resource/s...08.mp3
windows7-x64
1resource/s...08.mp3
windows10-2004-x64
6resource/s...09.mp3
windows7-x64
1resource/s...09.mp3
windows10-2004-x64
6resource/s...10.mp3
windows7-x64
1resource/s...10.mp3
windows10-2004-x64
6resource/s...11.mp3
windows7-x64
1resource/s...11.mp3
windows10-2004-x64
6resource/s...12.mp3
windows7-x64
1resource/s...12.mp3
windows10-2004-x64
6resource/s...01.mp3
windows7-x64
1resource/s...01.mp3
windows10-2004-x64
6resource/s...02.mp3
windows7-x64
1resource/s...02.mp3
windows10-2004-x64
6resource/s...03.mp3
windows7-x64
1resource/s...03.mp3
windows10-2004-x64
6resource/s...04.mp3
windows7-x64
1resource/s...04.mp3
windows10-2004-x64
6Analysis
-
max time kernel
87s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 13:24
Behavioral task
behavioral1
Sample
KakaoTalk_Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
KakaoTalk_Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
resource/sound/ns_1_01.mp3
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
resource/sound/ns_1_01.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
resource/sound/ns_1_02.mp3
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
resource/sound/ns_1_02.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
resource/sound/ns_1_03.mp3
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
resource/sound/ns_1_03.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
resource/sound/ns_1_04.mp3
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
resource/sound/ns_1_04.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
resource/sound/ns_1_05.mp3
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
resource/sound/ns_1_05.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
resource/sound/ns_1_06.mp3
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
resource/sound/ns_1_06.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
resource/sound/ns_1_08.mp3
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
resource/sound/ns_1_08.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
resource/sound/ns_1_09.mp3
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
resource/sound/ns_1_09.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
resource/sound/ns_1_10.mp3
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
resource/sound/ns_1_10.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
resource/sound/ns_1_11.mp3
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
resource/sound/ns_1_11.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
resource/sound/ns_1_12.mp3
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
resource/sound/ns_1_12.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
resource/sound/ns_2_01.mp3
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
resource/sound/ns_2_01.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
resource/sound/ns_2_02.mp3
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
resource/sound/ns_2_02.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
resource/sound/ns_2_03.mp3
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
resource/sound/ns_2_03.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
resource/sound/ns_2_04.mp3
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
resource/sound/ns_2_04.mp3
Resource
win10v2004-20240508-en
General
-
Target
resource/sound/ns_1_04.mp3
-
Size
20KB
-
MD5
0b06b0f4f0dca3f20d21bdf943f761f0
-
SHA1
36d6d3ecd1173ea350d2a0422133fcf5c79c6ef3
-
SHA256
1a1c6be97e89393ebe0318686f682d34e319736340b9048bc8e6e2b70d1eb2b5
-
SHA512
3b3f16a6ef41bb1ed0af377cf8b52ae38903e9b71821f590a12a8b7dab60a7502f731687d71e591c0058fd28bcd052e0304894c91c83f78f52c4814a95672ac9
-
SSDEEP
384:vicz+WIw1tQEjVLsexKXSYVI5cg9NkMXnOL9ROgrCU:M9wpLsekzVpg9Nl82kCU
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unregmp2.exedescription pid process Token: SeShutdownPrivilege 2064 unregmp2.exe Token: SeCreatePagefilePrivilege 2064 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wmplayer.exeunregmp2.exedescription pid process target process PID 2128 wrote to memory of 1776 2128 wmplayer.exe setup_wm.exe PID 2128 wrote to memory of 1776 2128 wmplayer.exe setup_wm.exe PID 2128 wrote to memory of 1776 2128 wmplayer.exe setup_wm.exe PID 2128 wrote to memory of 3840 2128 wmplayer.exe unregmp2.exe PID 2128 wrote to memory of 3840 2128 wmplayer.exe unregmp2.exe PID 2128 wrote to memory of 3840 2128 wmplayer.exe unregmp2.exe PID 3840 wrote to memory of 2064 3840 unregmp2.exe unregmp2.exe PID 3840 wrote to memory of 2064 3840 unregmp2.exe unregmp2.exe
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\resource\sound\ns_1_04.mp3"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\resource\sound\ns_1_04.mp3"2⤵PID:1776
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
256KB
MD5adbd8353954edbe5e0620c5bdcad4363
SHA1aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6
SHA25664eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55
SHA51287bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD5f322d9f53f97481844aaa60dfa151d97
SHA197c100e6a5291b401686afd20bf0ffe05cc0f483
SHA2566b99179c4c3ef130173efaba19534d72bc9140f6c353b8ae2374c1f034e23606
SHA5129bd406b56bff03b1d2ffd29018df9b5bfb496a7c73847b5d69d6b3641dadb241519cd90223dd5a64ed22b7936053be74474379fa20b73ac1f417870a04244ad8