Overview
overview
6Static
static
3Touhou PC9...on.zip
windows7-x64
1Touhou PC9...on.zip
windows10-2004-x64
1Touhou PC9...BD.wav
windows7-x64
1Touhou PC9...BD.wav
windows10-2004-x64
6Touhou PC9...HH.wav
windows7-x64
1Touhou PC9...HH.wav
windows10-2004-x64
6Touhou PC9...IM.wav
windows7-x64
1Touhou PC9...IM.wav
windows10-2004-x64
6Touhou PC9...SD.wav
windows7-x64
1Touhou PC9...SD.wav
windows10-2004-x64
6Touhou PC9...OM.wav
windows7-x64
1Touhou PC9...OM.wav
windows10-2004-x64
6Touhou PC9...OP.wav
windows7-x64
1Touhou PC9...OP.wav
windows10-2004-x64
6Touhou PC9...ED.txt
windows7-x64
1Touhou PC9...ED.txt
windows10-2004-x64
1Touhou PC9...NT.rom
windows7-x64
3Touhou PC9...NT.rom
windows10-2004-x64
3Touhou PC9...nt.exe
windows7-x64
3Touhou PC9...nt.exe
windows10-2004-x64
3Touhou PC9...nt.ini
windows7-x64
1Touhou PC9...nt.ini
windows10-2004-x64
1Touhou PC9...01.bat
windows7-x64
3Touhou PC9...01.bat
windows10-2004-x64
3Touhou PC9...1e.bat
windows7-x64
3Touhou PC9...1e.bat
windows10-2004-x64
3Touhou PC9...1e.hdi
windows7-x64
3Touhou PC9...1e.hdi
windows10-2004-x64
3Touhou PC9...1e.ini
windows7-x64
1Touhou PC9...1e.ini
windows10-2004-x64
1Touhou PC9...1j.bat
windows7-x64
3Touhou PC9...1j.bat
windows10-2004-x64
3Analysis
- max time kernel
127s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
02/09/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
Touhou PC98 Collection.zip
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
Touhou PC98 Collection.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Touhou PC98 Collection/GAMES/2608_BD.wav
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
Touhou PC98 Collection/GAMES/2608_BD.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Touhou PC98 Collection/GAMES/2608_HH.wav
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
Touhou PC98 Collection/GAMES/2608_HH.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Touhou PC98 Collection/GAMES/2608_RIM.wav
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
Touhou PC98 Collection/GAMES/2608_RIM.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Touhou PC98 Collection/GAMES/2608_SD.wav
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
Touhou PC98 Collection/GAMES/2608_SD.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Touhou PC98 Collection/GAMES/2608_TOM.wav
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
Touhou PC98 Collection/GAMES/2608_TOM.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Touhou PC98 Collection/GAMES/2608_TOP.wav
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
Touhou PC98 Collection/GAMES/2608_TOP.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Touhou PC98 Collection/GAMES/ENHANCED.txt
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Touhou PC98 Collection/GAMES/ENHANCED.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Touhou PC98 Collection/GAMES/FONT.rom
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
Touhou PC98 Collection/GAMES/FONT.rom
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Touhou PC98 Collection/GAMES/np21nt.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
Touhou PC98 Collection/GAMES/np21nt.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Touhou PC98 Collection/GAMES/np21nt.ini
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
Touhou PC98 Collection/GAMES/np21nt.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Touhou PC98 Collection/GAMES/th01.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
Touhou PC98 Collection/GAMES/th01.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Touhou PC98 Collection/GAMES/th01e.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Touhou PC98 Collection/GAMES/th01e.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Touhou PC98 Collection/GAMES/th01e.hdi
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
Touhou PC98 Collection/GAMES/th01e.hdi
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Touhou PC98 Collection/GAMES/th01e.ini
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
Touhou PC98 Collection/GAMES/th01e.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Touhou PC98 Collection/GAMES/th01j.bat
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
Touhou PC98 Collection/GAMES/th01j.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target Touhou PC98 Collection/GAMES/2608_BD.wav
- Size 5KB
- Sample240902-l5mdwayeqg
- SHA256 083c383103948dc4f05ac2a4e1bd7f12c02924c7fcd81d98e0ae13f2b309ab2f
- MD5 29aad51cd243c8e449d311d14613f0b1
- SHA1 22fb2cd4412df057762c23dd22729ebcb922fe0e
- SHA512 684dea7440c99b1abd22055f5b1206b4f566eebf562e68fe7e2556804ece8f5ef084c09ede29f572a0e41e8f2e6010c1140fd5fb41d40f892260f427003e8b54
- SSDEEP 96:9vL8yrkE+vnOwRuODX/Y2I6mAzsSoCzRtxDU3Mw7HmD:9T8yrkWv0XcFSzzRLU3Mw8
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{13C7E75D-7ADC-447F-B345-941924D3CD7F} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 4004 unregmp2.exe Token: SeCreatePagefilePrivilege 4004 unregmp2.exe Token: SeShutdownPrivilege 924 wmplayer.exe Token: SeCreatePagefilePrivilege 924 wmplayer.exe Token: 33 2216 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2216 AUDIODG.EXE Token: SeShutdownPrivilege 924 wmplayer.exe Token: SeCreatePagefilePrivilege 924 wmplayer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 924 wmplayer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 924 wrote to memory of 3196 924 wmplayer.exe 86 PID 924 wrote to memory of 3196 924 wmplayer.exe 86 PID 924 wrote to memory of 3196 924 wmplayer.exe 86 PID 3196 wrote to memory of 4004 3196 unregmp2.exe 87 PID 3196 wrote to memory of 4004 3196 unregmp2.exe 87
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\2608_BD.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:2888
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
- MD5 987a07b978cfe12e4ce45e513ef86619
- SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
- SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
- SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 b5a5c1c99fee45f69e44a82f1b5a80e7577e4d6e7575ca29fdd7cd4af8f667dd
- MD5 fe91ba593aabe58af51106853df65eb2
- SHA1 7be832edb7c6462d04c0a181f4215e61bb8019e9
- SHA512 cca1b70227a5e51a6c22afb10c2ca54e20e847f3351fd768365e9e8dd25239a9351f2d0d80927e44678110f2a20caa901cdca7d0c30abbfe47d19ac207650213
- SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaw:rZP2tFP3vqY8EqEMmTaBacg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 e2c529bd4909822d648543479660e0f78c5cd44bc9c50376f8dd94b9e96550d4
- MD5 7822bb1c833f6c2b1d53429eba789004
- SHA1 c6439284514b3f3c9d010bf7833c80061484e3bc
- SHA512 5a02f2a4cc4bb13eac141f6dee5fa7cdc273e1892ea10aaca656896579234a6fd4d93a81f17f13ba00ea1c1cba1684c25444a3d88ffab7ba4bda02136a5e7069
- SSDEEP 96:Q0lVRPlteNXtbUMUstD7Xt4UMbst/UMlst4OXthL2tGLXtit9At7t:QiVRsnCn6nq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
- MD5 5433eab10c6b5c6d55b7cbd302426a39
- SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
- SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
- SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 ecffae4711731fbcad97a3060993e7bf9f405f19a9ee242b12de66d1394e4548
- MD5 da2047e11e838444bb8644191d46bbe4
- SHA1 ac52485e9bc220b4a55dfadbb531d3c332f735ea
- SHA512 1898c960623ca9e2396b94a0a7493ee9dddb578b716eba7db7d1f501e08c5a389df3ee67d3828a28ec95124a56fc69dafe4e469b2021c2669589420f9e86c775
- MD5 SHA1 SHA512