Overview
overview
7Static
static
7KakaoTalk_Setup.exe
windows7-x64
3KakaoTalk_Setup.exe
windows10-2004-x64
7resource/s...01.mp3
windows7-x64
1resource/s...01.mp3
windows10-2004-x64
6resource/s...02.mp3
windows7-x64
1resource/s...02.mp3
windows10-2004-x64
6resource/s...03.mp3
windows7-x64
1resource/s...03.mp3
windows10-2004-x64
6resource/s...04.mp3
windows7-x64
1resource/s...04.mp3
windows10-2004-x64
6resource/s...05.mp3
windows7-x64
1resource/s...05.mp3
windows10-2004-x64
6resource/s...06.mp3
windows7-x64
1resource/s...06.mp3
windows10-2004-x64
6resource/s...08.mp3
windows7-x64
1resource/s...08.mp3
windows10-2004-x64
6resource/s...09.mp3
windows7-x64
1resource/s...09.mp3
windows10-2004-x64
6resource/s...10.mp3
windows7-x64
1resource/s...10.mp3
windows10-2004-x64
6resource/s...11.mp3
windows7-x64
1resource/s...11.mp3
windows10-2004-x64
6resource/s...12.mp3
windows7-x64
1resource/s...12.mp3
windows10-2004-x64
6resource/s...01.mp3
windows7-x64
1resource/s...01.mp3
windows10-2004-x64
6resource/s...02.mp3
windows7-x64
1resource/s...02.mp3
windows10-2004-x64
6resource/s...03.mp3
windows7-x64
1resource/s...03.mp3
windows10-2004-x64
6resource/s...04.mp3
windows7-x64
1resource/s...04.mp3
windows10-2004-x64
6Analysis
-
max time kernel
47s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 13:24
Behavioral task
behavioral1
Sample
KakaoTalk_Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
KakaoTalk_Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
resource/sound/ns_1_01.mp3
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
resource/sound/ns_1_01.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
resource/sound/ns_1_02.mp3
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
resource/sound/ns_1_02.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
resource/sound/ns_1_03.mp3
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
resource/sound/ns_1_03.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
resource/sound/ns_1_04.mp3
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
resource/sound/ns_1_04.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
resource/sound/ns_1_05.mp3
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
resource/sound/ns_1_05.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
resource/sound/ns_1_06.mp3
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
resource/sound/ns_1_06.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
resource/sound/ns_1_08.mp3
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
resource/sound/ns_1_08.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
resource/sound/ns_1_09.mp3
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
resource/sound/ns_1_09.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
resource/sound/ns_1_10.mp3
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
resource/sound/ns_1_10.mp3
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
resource/sound/ns_1_11.mp3
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
resource/sound/ns_1_11.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
resource/sound/ns_1_12.mp3
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
resource/sound/ns_1_12.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
resource/sound/ns_2_01.mp3
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
resource/sound/ns_2_01.mp3
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
resource/sound/ns_2_02.mp3
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
resource/sound/ns_2_02.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
resource/sound/ns_2_03.mp3
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
resource/sound/ns_2_03.mp3
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
resource/sound/ns_2_04.mp3
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
resource/sound/ns_2_04.mp3
Resource
win10v2004-20240508-en
General
-
Target
resource/sound/ns_1_03.mp3
-
Size
22KB
-
MD5
ecbdb36d82691f7b8bd81d520fcfa156
-
SHA1
a7aa28a6ca1d704fe209110d6063ad71fa756c35
-
SHA256
5534a1a106441b64400be52bad51597f7a276e87e89bdcf2a46d0f3cdc4909c0
-
SHA512
cbb609a2282af935e71226ec358448b6ffb845443271c36000604eab8acc6990a985971abfe902028de471a82c557aa88fcdcfd852f880491b305801908617d6
-
SSDEEP
384:YaBTIStbuil81ECKigp42Cb0ans7ixMw96QyIk+EkVPfyc9d/fRZ:Y40Wbui6fgkhnXMwYo1xfFXZ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unregmp2.exedescription pid process Token: SeShutdownPrivilege 2848 unregmp2.exe Token: SeCreatePagefilePrivilege 2848 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wmplayer.exeunregmp2.exedescription pid process target process PID 3608 wrote to memory of 1688 3608 wmplayer.exe setup_wm.exe PID 3608 wrote to memory of 1688 3608 wmplayer.exe setup_wm.exe PID 3608 wrote to memory of 1688 3608 wmplayer.exe setup_wm.exe PID 3608 wrote to memory of 2332 3608 wmplayer.exe unregmp2.exe PID 3608 wrote to memory of 2332 3608 wmplayer.exe unregmp2.exe PID 3608 wrote to memory of 2332 3608 wmplayer.exe unregmp2.exe PID 2332 wrote to memory of 2848 2332 unregmp2.exe unregmp2.exe PID 2332 wrote to memory of 2848 2332 unregmp2.exe unregmp2.exe
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\resource\sound\ns_1_03.mp3"1⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\resource\sound\ns_1_03.mp3"2⤵PID:1688
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
64KB
MD5987a07b978cfe12e4ce45e513ef86619
SHA122eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA256f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
SHA51239b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD5afc2930909ddf809469ede0368f93449
SHA13a1f9b037799e6528aacc5b6d25586e6d828fce1
SHA256cbb1f66d57c507a19dd0abd18c73fc57ca493819775bc992c40d36b9fcd0e10a
SHA51230334106bbbacbf9da5488297c289f4c6b8c8dd6e197d783fa7a501670f653f40b6b524a487c8282791d6a943b7329a635e1d2ddc33024f74293aff7c03c31d2