Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 14:33

General

  • Target

    VID_20230808_005209_707_2.mp4

  • Size

    6.2MB

  • MD5

    31dd8769943503916a9b4552b65892ca

  • SHA1

    3fb4e07ac1ad780d130415668915ac085b852a34

  • SHA256

    00963755bfb6e81ca083ecbde84207ac010d418cdedce3cf46931e816614b08c

  • SHA512

    587b3baaaefcb91bbbf8925792936f9b1e061dc59f497b0cdd022571a22b0af660fad1c54a5f852def89e5334b954ce01b4affdf8f31be1ed16f28b2cf82b05d

  • SSDEEP

    196608:iMMjz1aHqZgZoWHrSQb97P2wwmcnK3Ii7:iR/1SegZoWmQB7TcK3Ii7

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\VID_20230808_005209_707_2.mp4"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:3660
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4f8 0x43c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    64KB

    MD5

    987a07b978cfe12e4ce45e513ef86619

    SHA1

    22eec9a9b2e83ad33bedc59e3205f86590b7d40c

    SHA256

    f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

    SHA512

    39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    1024KB

    MD5

    a082df3997336ef6d333da0345f06b77

    SHA1

    53dfed1c3b30480eed51250ed5a5275b475a4367

    SHA256

    405cd5674dbde8b414e430c41aff7eb4d92406a7f860d6df2f3dc56571d4ce53

    SHA512

    f888cadd01e03c9c3235361225cbe213c96723ae53dfe358ebbdb6a5ad718baf09ad3c67d5ab93d93096c2cfcbd3359a7d31febb3f496a5647b9cb279cebb005

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

    Filesize

    68KB

    MD5

    b3e5414f9e67aa2ff82073772c26b4d7

    SHA1

    8716fbff89e41ff2cfef5850f18dbcbee6c5ffff

    SHA256

    71cf31951a5f46541d3a34026d51f7662b2f42bbc43cd35f2ed5a946bc742376

    SHA512

    0130da0dc2bdde55eb28f8cbdc1ce7322dab1d26dbcdbe63c1fcc4ac9df0d94efc1587f73bbb548734fb485501c7a0fa5032b683ea752804889d6bfbae7da1a9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

    Filesize

    498B

    MD5

    90be2701c8112bebc6bd58a7de19846e

    SHA1

    a95be407036982392e2e684fb9ff6602ecad6f1e

    SHA256

    644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

    SHA512

    d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    1KB

    MD5

    d51376addcf3754903e65feb9ede6453

    SHA1

    b48fc517a2a8a7443ea0dd7a8d012b777eaf9e76

    SHA256

    0ec6074f0f0e67491a39e5adbc0dd61e78b625cd9445938ced919255a4bcdee5

    SHA512

    14383910318550ee354c7a6734a0000f807b45eee8c8653e6ce0f976aca3c9b0d6f50647f34944e63bdc4c06baf8e5e2e186378489e613cc0bb26a2572c434eb

  • memory/4900-34-0x0000000005000000-0x0000000005010000-memory.dmp

    Filesize

    64KB

  • memory/4900-33-0x0000000005000000-0x0000000005010000-memory.dmp

    Filesize

    64KB

  • memory/4900-32-0x0000000005000000-0x0000000005010000-memory.dmp

    Filesize

    64KB

  • memory/4900-31-0x0000000005000000-0x0000000005010000-memory.dmp

    Filesize

    64KB

  • memory/4900-37-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

    Filesize

    64KB

  • memory/4900-38-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-39-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-41-0x0000000005000000-0x0000000005010000-memory.dmp

    Filesize

    64KB

  • memory/4900-40-0x0000000005000000-0x0000000005010000-memory.dmp

    Filesize

    64KB

  • memory/4900-42-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-51-0x00000000052B0000-0x00000000052C0000-memory.dmp

    Filesize

    64KB

  • memory/4900-53-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-55-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-56-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-57-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-58-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-59-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-60-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-61-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-63-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-64-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-62-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-68-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-69-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-70-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-71-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-73-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-72-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-74-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-75-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-76-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-77-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-80-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-79-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-81-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-82-0x00000000052B0000-0x00000000052C0000-memory.dmp

    Filesize

    64KB

  • memory/4900-83-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-85-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-84-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-88-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-90-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-89-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-93-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-92-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-91-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-87-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-86-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-94-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-96-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-95-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-97-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-99-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-98-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-100-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-101-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-102-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-103-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-104-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-106-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-107-0x00000000052B0000-0x00000000052C0000-memory.dmp

    Filesize

    64KB

  • memory/4900-105-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB

  • memory/4900-108-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-109-0x0000000007260000-0x0000000007270000-memory.dmp

    Filesize

    64KB

  • memory/4900-110-0x0000000009C50000-0x0000000009C60000-memory.dmp

    Filesize

    64KB