Overview
overview
6Static
static
3Touhou PC9...on.zip
windows7-x64
1Touhou PC9...on.zip
windows10-2004-x64
1Touhou PC9...BD.wav
windows7-x64
1Touhou PC9...BD.wav
windows10-2004-x64
6Touhou PC9...HH.wav
windows7-x64
1Touhou PC9...HH.wav
windows10-2004-x64
6Touhou PC9...IM.wav
windows7-x64
1Touhou PC9...IM.wav
windows10-2004-x64
6Touhou PC9...SD.wav
windows7-x64
1Touhou PC9...SD.wav
windows10-2004-x64
6Touhou PC9...OM.wav
windows7-x64
1Touhou PC9...OM.wav
windows10-2004-x64
6Touhou PC9...OP.wav
windows7-x64
1Touhou PC9...OP.wav
windows10-2004-x64
6Touhou PC9...ED.txt
windows7-x64
1Touhou PC9...ED.txt
windows10-2004-x64
1Touhou PC9...NT.rom
windows7-x64
3Touhou PC9...NT.rom
windows10-2004-x64
3Touhou PC9...nt.exe
windows7-x64
3Touhou PC9...nt.exe
windows10-2004-x64
3Touhou PC9...nt.ini
windows7-x64
1Touhou PC9...nt.ini
windows10-2004-x64
1Touhou PC9...01.bat
windows7-x64
3Touhou PC9...01.bat
windows10-2004-x64
3Touhou PC9...1e.bat
windows7-x64
3Touhou PC9...1e.bat
windows10-2004-x64
3Touhou PC9...1e.hdi
windows7-x64
3Touhou PC9...1e.hdi
windows10-2004-x64
3Touhou PC9...1e.ini
windows7-x64
1Touhou PC9...1e.ini
windows10-2004-x64
1Touhou PC9...1j.bat
windows7-x64
3Touhou PC9...1j.bat
windows10-2004-x64
3Analysis
- max time kernel
128s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
02/09/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
Touhou PC98 Collection.zip
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
Touhou PC98 Collection.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Touhou PC98 Collection/GAMES/2608_BD.wav
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
Touhou PC98 Collection/GAMES/2608_BD.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Touhou PC98 Collection/GAMES/2608_HH.wav
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
Touhou PC98 Collection/GAMES/2608_HH.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Touhou PC98 Collection/GAMES/2608_RIM.wav
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
Touhou PC98 Collection/GAMES/2608_RIM.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Touhou PC98 Collection/GAMES/2608_SD.wav
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
Touhou PC98 Collection/GAMES/2608_SD.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Touhou PC98 Collection/GAMES/2608_TOM.wav
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
Touhou PC98 Collection/GAMES/2608_TOM.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Touhou PC98 Collection/GAMES/2608_TOP.wav
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
Touhou PC98 Collection/GAMES/2608_TOP.wav
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Touhou PC98 Collection/GAMES/ENHANCED.txt
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Touhou PC98 Collection/GAMES/ENHANCED.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Touhou PC98 Collection/GAMES/FONT.rom
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
Touhou PC98 Collection/GAMES/FONT.rom
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Touhou PC98 Collection/GAMES/np21nt.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
Touhou PC98 Collection/GAMES/np21nt.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Touhou PC98 Collection/GAMES/np21nt.ini
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
Touhou PC98 Collection/GAMES/np21nt.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Touhou PC98 Collection/GAMES/th01.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
Touhou PC98 Collection/GAMES/th01.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Touhou PC98 Collection/GAMES/th01e.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Touhou PC98 Collection/GAMES/th01e.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Touhou PC98 Collection/GAMES/th01e.hdi
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
Touhou PC98 Collection/GAMES/th01e.hdi
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Touhou PC98 Collection/GAMES/th01e.ini
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
Touhou PC98 Collection/GAMES/th01e.ini
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Touhou PC98 Collection/GAMES/th01j.bat
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
Touhou PC98 Collection/GAMES/th01j.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target Touhou PC98 Collection/GAMES/2608_RIM.wav
- Size 4KB
- Sample240902-l5mdwayeqg
- SHA256 a888509403eea148155662ac3714509b62b408a0609e94835b2e2f2761f3b678
- MD5 943290d1c5c6ae6295bd02be4411c7c0
- SHA1 4ecf900db8d0f69d6154bde376206d727ddddaae
- SHA512 c5919b38f2abe7de4e57ffdf348dcc78e15d0aba901633d5c64ac4c0c1ebc95e09295d4c387355190af0aef6c73c80fb653c1285946633ca6a71a036e866faa0
- SSDEEP 48:nvSLJHiQRc59Db/XJnPaydG3BFJYzCEYuVi8MT2x/zz2gv+8KOFNn:vSLJCQyb5PayaaRVi8MT2xXXKOFV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{4FE29C53-CD5D-4CF4-8FDB-145F1DAA0E40} wmplayer.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 664 wmplayer.exe Token: SeCreatePagefilePrivilege 664 wmplayer.exe Token: SeShutdownPrivilege 2536 unregmp2.exe Token: SeCreatePagefilePrivilege 2536 unregmp2.exe Token: 33 2376 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2376 AUDIODG.EXE Token: SeShutdownPrivilege 664 wmplayer.exe Token: SeCreatePagefilePrivilege 664 wmplayer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 664 wmplayer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 664 wrote to memory of 556 664 wmplayer.exe 85 PID 664 wrote to memory of 556 664 wmplayer.exe 85 PID 664 wrote to memory of 556 664 wmplayer.exe 85 PID 556 wrote to memory of 2536 556 unregmp2.exe 86 PID 556 wrote to memory of 2536 556 unregmp2.exe 86
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Touhou PC98 Collection\GAMES\2608_RIM.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:1920
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x458 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 576KB
- SHA256 65ac91d9fa770fe2025fa0866dcdbad3a33087f3aa7974150ad0d6d0c2b87432
- MD5 ed6403a9e04010f1dec738de07aa712e
- SHA1 1c106b90e799899f7b7d87430272720f05a47b2f
- SHA512 1ac9e6c73f062b10b5af5abf4131827ef347ecaf2295168d2f0ff92a03513a97634a2dcc0dbad40cd4427446fc76673749bbea4988eade919608d174117654b4
- SSDEEP 768:5f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3w:569tQeoVYocxYCutFCiKt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 8507f3743b016c8377cb0f74bc82baf1eb229a27fb5cb1660792fdebaba72d9d
- MD5 f76b39b15f5fe0ef460c9a64e8cb1cb4
- SHA1 e19f0e189ce1d1d16c5dcd635e0f585960490e1c
- SHA512 3de2ea150b8c2bc074864fca7b7a394ee971d0640333c39ada74ede5d2599a8d85e5d9140196257b57bca35260c694315c537eb8cf829585f0ec1617cd5c0d18
- SSDEEP 768:l0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaZ:jZP2tFP3vqY82qEMnjTaBacg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 ebc2beed9acdb6db5d2221a58fdab66c89671742ec5a81c7626e3ecc3b955b12
- MD5 0146f7d8d8e54dd382f16ecdf3c3340d
- SHA1 2a9ab42ce9196f139e7beb434a23f2018e24477a
- SHA512 d5f85469bdd4480e31e8ebaaff69fba6442e3eac051c3b5e01ccfec0fdcba52f6f8d4815cc0718a5c2862cc6de4b2eaa88eb8e5e137b5f79c7b1839da7257333
- SSDEEP 96:7RErltWNXtjUMUstr7XtAUMbst3UMlstAOXt5L2teLXtqt1AtTt5:7KoninSna
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 b5a72b9b3a0f3936019f2ab919697fbdff7ffa43f3a8c78a4d4871d22eaa2f88
- MD5 4160ea25aa8a663171af1ba2828befa0
- SHA1 140e5008b002b027d29433010ff846476a409560
- SHA512 d34ef6b0f42f5a1187222f088b7a30c8e231c1c04303880c549a4ef6ac538a37c43f8e6cf1d2cc275f63fa710a607b43ce9d7d80c75cdbbec26f902203dcf110
- MD5 SHA1 SHA512