1883ccb187c36fff790979e0066de0410ab9f57415eea8d9db3283c432b5103e

Analysis

max time kernel
104s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VID-20240229-WA0015.mp4
Size

276KB
MD5

76e580cfaabc2400c03c476daf1376bb
SHA1

afeb46ac58bebb829bfd7052b9a017f961eadaf6
SHA256

1883ccb187c36fff790979e0066de0410ab9f57415eea8d9db3283c432b5103e
SHA512

641e20e78c9d2445709cfea37f51c8e2031e2b0888467ac9a4c10fa2de2b531fb9ef94e00dd241555f8db9865e06fed5cfdce77e02b3ce63b579ec96a01d8fc1
SSDEEP

6144:VGDStZb/zbpTTJSWBQoyQD7q1vvr5HP9XAaXi6v:VTtZbPJ8WqH6q1vjBP9F

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{4B5732A0-FE84-4576-83E4-EAAA3C1D9D5C}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	668	unregmp2.exe
Token: SeCreatePagefilePrivilege	668	unregmp2.exe
Token: SeShutdownPrivilege	4528	wmplayer.exe
Token: SeCreatePagefilePrivilege	4528	wmplayer.exe
Token: 33	752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	752	AUDIODG.EXE
Token: SeShutdownPrivilege	4528	wmplayer.exe
Token: SeCreatePagefilePrivilege	4528	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4528	wmplayer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3628	4016	wmplayer.exe	81
PID 4016 wrote to memory of 3628	4016	wmplayer.exe	81
PID 4016 wrote to memory of 3628	4016	wmplayer.exe	81
PID 4016 wrote to memory of 4912	4016	wmplayer.exe	82
PID 4016 wrote to memory of 4912	4016	wmplayer.exe	82
PID 4016 wrote to memory of 4912	4016	wmplayer.exe	82
PID 4912 wrote to memory of 668	4912	unregmp2.exe	83
PID 4912 wrote to memory of 668	4912	unregmp2.exe	83
PID 3628 wrote to memory of 1768	3628	setup_wm.exe	88
PID 3628 wrote to memory of 1768	3628	setup_wm.exe	88
PID 3628 wrote to memory of 1768	3628	setup_wm.exe	88
PID 1768 wrote to memory of 1744	1768	unregmp2.exe	89
PID 1768 wrote to memory of 1744	1768	unregmp2.exe	89
PID 3628 wrote to memory of 4528	3628	setup_wm.exe	90
PID 3628 wrote to memory of 4528	3628	setup_wm.exe	90
PID 3628 wrote to memory of 4528	3628	setup_wm.exe	90

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\VID-20240229-WA0015.mp4"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\VID-20240229-WA0015.mp4"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:1744
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\VID-20240229-WA0015.mp4"
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4528
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4980

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
563088ad0f20fabf9dd62c6ba8ae1636

SHA1
f9cd2fd153afa1a12ff990cf27c32b8c9c44e878

SHA256
eb897bf202d32f067728f1b666eb16e9926557efa8676b72db11411013030184

SHA512
8229dfb1d96b6a34b91b1e5c463833e7859331be880f585c48af1ba0ace0465ac755c7f22a9e6f30284266165f850e8f85af76157eea8136b2d6f79db02d3092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
b9368b97c07d947fdc8a1bf7c9807041

SHA1
f7a25555015d9f2bc69d71e6d22405a43a75a3f8

SHA256
fc1b97c2af1e938e78afea870ab4b924a4d8c08f111d96f35ee3c13788eb2ee2

SHA512
6018429cea1d56dd65ca410b3a121a7fb2fe6c688df186586d64573f7514cb87cf74dd55dfa40f04e158439d13502d13228cf0a4793cf5d2cc82a46578e85c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
13d9f5cecba5ab250af7f3eca556f188

SHA1
428c0d52d8c9ddfac2e1de197ecbbfe5f4a0ec4f

SHA256
2d24f62f1437ffe8b4cf86ab7e959a10ca6dfb2bfcff877e43e53d5f8253c9e2

SHA512
db3574c7833916dfdac009e1a941241011a191ac23264e1b69419a2bdca1da2f87d868078eaa35450ed5ff55542c7a0a847f3921e433867f9c5e6324e794efcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
b07943f33a0ad6ffa863b035bc997491

SHA1
f3999aca738dc5e3af38e17d1c5a3a447e45ce33

SHA256
8929218fec3f9f43f3694f7ab55300e98e761079512c176fd9eaa707c36f7063

SHA512
45cad4e594ab1b002f89ebff77229121d63c4cef433dfa1c96bcd2a2cab70af986ba097cf2d6e7752687090d71bf168582d401b3b33f42517e33a822b3d77968

Download Submit
memory/4528-41-0x0000000004010000-0x0000000004020000-memory.dmp

Filesize
64KB

Download
memory/4528-44-0x0000000004010000-0x0000000004020000-memory.dmp

Filesize
64KB

Download
memory/4528-43-0x0000000004010000-0x0000000004020000-memory.dmp

Filesize
64KB

Download
memory/4528-42-0x0000000004010000-0x0000000004020000-memory.dmp

Filesize
64KB

Download
memory/4528-47-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/4528-48-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-51-0x0000000004010000-0x0000000004020000-memory.dmp

Filesize
64KB

Download
memory/4528-50-0x0000000004010000-0x0000000004020000-memory.dmp

Filesize
64KB

Download
memory/4528-49-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-52-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-56-0x00000000040C0000-0x00000000040D0000-memory.dmp

Filesize
64KB

Download
memory/4528-59-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-60-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-61-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-62-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-63-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-64-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-66-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-65-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-69-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-68-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-67-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-71-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-76-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-75-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-74-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-73-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-72-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-79-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-80-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-81-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-82-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-84-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-85-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-87-0x00000000040C0000-0x00000000040D0000-memory.dmp

Filesize
64KB

Download
memory/4528-86-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-88-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-89-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-90-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-91-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-93-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-92-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-95-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-98-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-97-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-96-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-94-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-99-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-101-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-102-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-104-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-103-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-100-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-105-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-106-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-107-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-108-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-109-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-111-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-112-0x00000000040C0000-0x00000000040D0000-memory.dmp

Filesize
64KB

Download
memory/4528-110-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-113-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download
memory/4528-115-0x0000000008870000-0x0000000008880000-memory.dmp

Filesize
64KB

Download
memory/4528-114-0x0000000008860000-0x0000000008870000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads