1b68640aa8fd10bd30af2f5a3e0a2a04bc203300fabbbc2401473c07be264632

Analysis

max time kernel
613s
max time network
1601s
platform
windows10-1703_x64
resource
win10-20240404-es
resource tags

arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
20-06-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$INSTDIR$_8_/Data/amp_models/Marshall JTM45 - Blackface Deluxe.wav
Size

4KB
MD5

5a37e73820fd7f3372fbba5edafe96ce
SHA1

ca3362c2870cac126af0f384eb49e168e28c8986
SHA256

98faf64b07b18df56c2d3f0c9044fa1f93926656697401dec5eeffbd8bd142d7
SHA512

e8ce11bcc9ef8084dcc197685b411596e47f2d1dde88989ddb1e24383b5f96a8b981c594855231ef29ec3841c1545e072a4cf7a866ca6a1c25e4ed2617b80c73
SSDEEP

6:MRtgUu+IRu48p8IL+h0mEgLe3Vl4vpb/9SWv7XwX00mctEa4osM8vmg5gCg:MbgROx2IL20mEgL66xbkWv7ANtdOvbHg

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3064	unregmp2.exe
Token: SeCreatePagefilePrivilege	3064	unregmp2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4820	4940	wmplayer.exe	74
PID 4940 wrote to memory of 4820	4940	wmplayer.exe	74
PID 4940 wrote to memory of 4820	4940	wmplayer.exe	74
PID 4940 wrote to memory of 1324	4940	wmplayer.exe	75
PID 4940 wrote to memory of 1324	4940	wmplayer.exe	75
PID 4940 wrote to memory of 1324	4940	wmplayer.exe	75
PID 1324 wrote to memory of 3064	1324	unregmp2.exe	76
PID 1324 wrote to memory of 3064	1324	unregmp2.exe	76

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\$INSTDIR$_8_\Data\amp_models\Marshall JTM45 - Blackface Deluxe.wav"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\$INSTDIR$_8_\Data\amp_models\Marshall JTM45 - Blackface Deluxe.wav"
  2⤵
  PID:4820
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\System32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
576KB

MD5
854b8ce1482a7b338fb59a941e7449dc

SHA1
47f50f7513beb4f9f8e06fe2b51f19790bb03b0a

SHA256
8e66dec7034db266971bf63ecd69333418c55a4ef5b73d7a3df47b821a8b6484

SHA512
ebb5c6128ae0e6cbbc95a70086d914b1606561eb9fb8e4b24fdc8d76f7ee191e631965ae33916fc3ea7beeab1f0d636a756335c41388765eeeb2ad735ec407f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp19078.WMC\allservices.xml

Filesize
546B

MD5
df03e65b8e082f24dab09c57bc9c6241

SHA1
6b0dacbf38744c9a381830e6a5dc4c71bd7cedbf

SHA256
155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba

SHA512
ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp21015.WMC\serviceinfo.xml

Filesize
523B

MD5
d58da90d6dc51f97cb84dfbffe2b2300

SHA1
5f86b06b992a3146cb698a99932ead57a5ec4666

SHA256
93acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad

SHA512
7f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
d60eb5dfaaa6b6f6559e789fb1704d4c

SHA1
2e1b27a56dc7fe30341ceed9f9e419a02edaa022

SHA256
43df231ac982677f8003db2c2ea4983e51bc748f2fd438eff00bf9f549f2cf36

SHA512
1de350f55632e327a61bbd590fc77a8091ac3293a17e1aeb61a62843480eedb2bca633caa9fa6c9d8d74e43861198c3c548c3c9b7fe4dea456cd9620a088f944

Download Submit