Overview

overview

8

Static

static

1

sakpot.wav

windows10-1703-x64

8

Resubmissions

12/07/2024, 20:20

240712-y4skqaydmr 6

12/07/2024, 20:17

240712-y27xmaydjp 8

12/07/2024, 20:14

240712-yz5z9aycmn 1

Analysis

  • max time kernel
    107s
  • max time network
    79s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/07/2024, 20:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sakpot.wav

  • Size

    904KB

  • MD5

    d5feae5eafc1f13baa7137643e1c7a02

  • SHA1

    b4faaa939e37f2eccfee393ae05bbc5f0774ee15

  • SHA256

    73126f92ba08563c36ee61ac98b78393ec2e74734093265869ca81f590e9ae88

  • SHA512

    e82b92ff2d3101b6ad59e4d103a3784f852d5e51c2a674c7d6bf0192b5d9cc2188e0e5bed7169db6aa66b5ccb93aae393ac3b9ef484a0f201fe079ea3896f155

  • SSDEEP

    12288:Vm7M34s2nDCQmFNYS/ClfK+UIdfkxcGa6eMwdmYQg8EI06UXq0RtJyspgXB1ZPvb:tlqcClndzGaNMOmYV8EI06UXpwsWxbr

Score
8/10
persistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 29 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\sakpot.wav"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3804
      • C:\Windows\System32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:4344
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:4732
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x420
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4836
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4912
  • \??\c:\windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1604
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
    Filesize

    384KB

    MD5

    9574d26ecc89d8ef027e51b9e47f2bc9

    SHA1

    1d6e6c558321dde60102ba63accf08b0a7d74cc5

    SHA256

    6dc988b85852834380f897e1b13c9a6e4f3f9bb6ae63ed3974b1005a979d6ebe

    SHA512

    60d552bcecc6c46d4e4c0c8f514cdcd9afde6256002ecb54342a2118ed496694485f1d2cda7082560f9a94b9ba1fb8da9bdd47f69a761a54873b51ad88e4ba7e

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
    Filesize

    1024KB

    MD5

    5ea85260f110cb621ad4ba5e30fe68f4

    SHA1

    8756c606a2ce1ca746dd76892243e9839237bb5d

    SHA256

    2953e14493172378461343c0b908e89dd3b77230fbcca38c27c7e1287e7f60fc

    SHA512

    b61c24986b8b1407058d1160938b4624e41f8a64078189372a2f4a322a1cf148ccf8abdf88e4ec55a2c3cb07bd430f5b3b5096d666e3432b3c6b699916dd1b96

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log
    Filesize

    1KB

    MD5

    53df10b326da86aa9aea1fd562d8a5e0

    SHA1

    c37e33338a4a382987c03b02bf878f8be705d518

    SHA256

    cfee1cd5864fab1329c0029fcf990cccbefb97808a56df804398f10b4d2c862c

    SHA512

    ceb794e6806f276092c43059cea017755dbcf1b62b3bb71b8aa830ebfce3a84a28a06c4fa4fd208b1102d25877b28700af52e363da7fa9d2283cb13a8a949307

    Download Submit

  • memory/1604-57-0x0000000002920000-0x0000000002921000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4040-32-0x0000000008510000-0x0000000008520000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4040-34-0x0000000008510000-0x0000000008520000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4040-36-0x0000000008510000-0x0000000008520000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4040-37-0x0000000008510000-0x0000000008520000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4040-35-0x0000000008510000-0x0000000008520000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4040-42-0x0000000008510000-0x0000000008520000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4040-33-0x0000000008510000-0x0000000008520000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4572-61-0x00000225FD700000-0x00000225FD800000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4572-66-0x00000225FDD80000-0x00000225FDDA0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4572-90-0x00000225FE140000-0x00000225FE160000-memory.dmp

    Filesize

    128KB

    Download