Analysis
-
max time kernel
15s -
max time network
20s -
platform
windows10-1703_x64 -
resource
win10-20240611-fr -
resource tags
arch:x64arch:x86image:win10-20240611-frlocale:fr-fros:windows10-1703-x64systemwindows -
submitted
28-08-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
Punchmade_Dev_-_6_Million_Official_Music_Video.mp4
Resource
win10-20240611-fr
Behavioral task
behavioral2
Sample
Punchmade_Dev_-_6_Million_Official_Music_Video.mp4
Resource
win11-20240802-fr
General
-
Target
Punchmade_Dev_-_6_Million_Official_Music_Video.mp4
-
Size
36B
-
MD5
a1ca4bebcd03fafbe2b06a46a694e29a
-
SHA1
ffc88125007c23ff6711147a12f9bba9c3d197ed
-
SHA256
c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
-
SHA512
6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 1448 wmplayer.exe Token: SeCreatePagefilePrivilege 1448 wmplayer.exe Token: SeShutdownPrivilege 1748 unregmp2.exe Token: SeCreatePagefilePrivilege 1748 unregmp2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1448 wmplayer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2692 1448 wmplayer.exe 70 PID 1448 wrote to memory of 2692 1448 wmplayer.exe 70 PID 1448 wrote to memory of 2692 1448 wmplayer.exe 70 PID 2692 wrote to memory of 1748 2692 unregmp2.exe 71 PID 2692 wrote to memory of 1748 2692 unregmp2.exe 71
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Punchmade_Dev_-_6_Million_Official_Music_Video.mp4"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\System32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s upnphost1⤵
- Drops file in Windows directory
PID:4156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e295d6eae8455ed26776229fbc094141
SHA113d1d104f3c8046923eb55d71be379b00d2ad68a
SHA2567bc7e6ac1dcf1a4ff7b2d326ee6a4eedebe57ff4a25fed31d451bad6c3c45ec7
SHA5121a5698211731c0d488f3d4965bad04b94663cc803a1539ea33c145bf05468eea18edebf0c7bdbedd66d6c9381d1f1898499ff3f4ebf6f2907abdb0b0b65bae1e
-
Filesize
498B
MD590be2701c8112bebc6bd58a7de19846e
SHA1a95be407036982392e2e684fb9ff6602ecad6f1e
SHA256644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
SHA512d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD5b4c747b345c3fbffdf014a9129106e9a
SHA1723cc1e0956778fa3da9c342f161e71cecf7a35d
SHA256585c96d4a179dafd5bdb243b695f4c8d1526f3cfcce062a41a635328b65424f2
SHA512bfecbfb9fea3b85954c29e24edf62997d5d147b9bb77905f82a8739a1010d77650fdc14f87156453edf3f30c1f93124a098897b5cbfd3b9d93ffaf9ae31aa482