Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 19:35
Static task
static1
Behavioral task
behavioral1
Sample
video_2024-06-06_21-58-03.avi
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
video_2024-06-06_21-58-03.avi
Resource
win10v2004-20240611-en
General
-
Target
video_2024-06-06_21-58-03.avi
-
Size
4.7MB
-
MD5
0d48316b4771db2b698e7343de2f9fdb
-
SHA1
78cbacc996628e6c54a689aade365a5ccee9d7cd
-
SHA256
39f13b867408e02352716b6f29226c54588d7585b0d641ee2aa377d4d9f4dc77
-
SHA512
f58f15b8859819c6f5f00fb3be8aad3b094e4cc8f7c468b8fb52565f0723ad4fce33f77241e70a2474d3ff0f43e1f78a121299c4d110b36924e5a7e065caf7ee
-
SSDEEP
98304:BuCc19KxWiwGKHCOhUU8BrCs2IOre1L/rD:BupeWnOf99/n
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unregmp2.exedescription pid process Token: SeShutdownPrivilege 812 unregmp2.exe Token: SeCreatePagefilePrivilege 812 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wmplayer.exeunregmp2.exedescription pid process target process PID 1544 wrote to memory of 1436 1544 wmplayer.exe setup_wm.exe PID 1544 wrote to memory of 1436 1544 wmplayer.exe setup_wm.exe PID 1544 wrote to memory of 1436 1544 wmplayer.exe setup_wm.exe PID 1544 wrote to memory of 2892 1544 wmplayer.exe unregmp2.exe PID 1544 wrote to memory of 2892 1544 wmplayer.exe unregmp2.exe PID 1544 wrote to memory of 2892 1544 wmplayer.exe unregmp2.exe PID 2892 wrote to memory of 812 2892 unregmp2.exe unregmp2.exe PID 2892 wrote to memory of 812 2892 unregmp2.exe unregmp2.exe
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "C:\Users\Admin\AppData\Local\Temp\video_2024-06-06_21-58-03.avi"1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "C:\Users\Admin\AppData\Local\Temp\video_2024-06-06_21-58-03.avi"2⤵PID:1436
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
256KB
MD5563088ad0f20fabf9dd62c6ba8ae1636
SHA1f9cd2fd153afa1a12ff990cf27c32b8c9c44e878
SHA256eb897bf202d32f067728f1b666eb16e9926557efa8676b72db11411013030184
SHA5128229dfb1d96b6a34b91b1e5c463833e7859331be880f585c48af1ba0ace0465ac755c7f22a9e6f30284266165f850e8f85af76157eea8136b2d6f79db02d3092
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bakFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD59029ed2c4977c11bbfff0f2b20e3ad38
SHA17d39afcc289c82b83c69bda5f423da3685039d98
SHA256b8fadafe9037390bc2750918c3bdd1c9ecfc4252f0b99d203a56207d7387b69f
SHA51238d02df9b12f605dd552b18cca3eb04cd17c69eca7aac0181285bdb2155b76d5975769c4c79cc23ff3be05ef3eb0ec2de719647fa0e9d2c8cd1315f9ebb6e269