0ebd6262c1467b03392c988e3af08c67821661040997d442299fc37fd633dbc5

Resubmissions

12-09-2024 20:50

240912-zmmtkstfkj 3

12-09-2024 20:47

240912-zlcxzsthne 6

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

angrybirdsmaker0.4.2.1-dist/angrybirdsmaker0.4.2.1-dist/ABM_0.4.2.1_ASDK_.compiled/data_sdk/audio/cypigs/cypig_collision_01.wav
Size

38KB
MD5

be34a6a349b4da9401695647affcb10e
SHA1

684e86dee1dc5c2ceba5c2aa9ae2081f1611fb2c
SHA256

db6b3d5e9346f77c40ac4efb38a837b97eb882ffba5a581eca6778aecffc13a1
SHA512

72541d6881d140a6ab0021f72c7119b2624f5874962fe1815bff2f1ca9a1ebfb0f9a2543757b97fa387a826357d51022237ca336392f7efa704ded80f6f5fa24
SSDEEP

768:3wyi7eLbFhir54r8VzXzj5ikTVCPCU+LjI2yPRfFgzg4Xc9YsuQFH2r:3tXPiKUvjZmC7py5WUDFHC

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{4AFD4216-E1F1-437F-B23A-C9633B456D50}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4768	unregmp2.exe
Token: SeCreatePagefilePrivilege	4768	unregmp2.exe
Token: SeShutdownPrivilege	2200	wmplayer.exe
Token: SeCreatePagefilePrivilege	2200	wmplayer.exe
Token: 33	2140	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2140	AUDIODG.EXE
Token: SeShutdownPrivilege	2200	wmplayer.exe
Token: SeCreatePagefilePrivilege	2200	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	wmplayer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2180	2200	wmplayer.exe	84
PID 2200 wrote to memory of 2180	2200	wmplayer.exe	84
PID 2200 wrote to memory of 2180	2200	wmplayer.exe	84
PID 2180 wrote to memory of 4768	2180	unregmp2.exe	85
PID 2180 wrote to memory of 4768	2180	unregmp2.exe	85

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\angrybirdsmaker0.4.2.1-dist\angrybirdsmaker0.4.2.1-dist\ABM_0.4.2.1_ASDK_.compiled\data_sdk\audio\cypigs\cypig_collision_01.wav"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
c374c25875887db7d072033f817b6ce1

SHA1
3a6d10268f30e42f973dadf044dba7497e05cdaf

SHA256
05d47b87b577841cc40db176ea634ec49b0b97066e192e1d48d84bb977e696b6

SHA512
6a14f81a300695c09cb335c13155144e562c86bb0ddfdcab641eb3a168877ad3fcc0579ad86162622998928378ea2ffe5a244b3ddbe6c11a959dbb34af374a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
4823f02b56881c0d5911ca5d491dd8bb

SHA1
53176409d2c15740ce6a352d98f2ccf3de864d9c

SHA256
cda9d761d6398e27ca7600509fe47177ead36b1bbeca8b01633883f243568234

SHA512
4f31c223afb4f63b5cacb2f7198a71b030a2b92ef1ea4ed3c99569580454db7b6b86a6744c2f41f86657c79978659a2650d7cbcee60de4e777e6a45f8f29c6b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
8dc97a49fd0711ed223c47e41854ccc5

SHA1
bf915a5789df7e23a38072526120e330dcbb69d2

SHA256
3c8ceeb71a9b81634635e5d2ceb352a3fbc0af70471ef761d89df9efe8820243

SHA512
a83e48b5cb067687512afaee632db7a01da2a171011bdaff326d7e0271b67943c6f87e537497bd9af0ef235a7989b4bf8419d62e4bc79dfa77f946b5698bc134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
23ca802e698c8266a5b293b2297deaa4

SHA1
a21a77381120b31fb80e92b9bd5c4b6765acb46f

SHA256
4ad1ba279caf5428c129427e367155b7a9058590883d231b58a740611fd40b0c

SHA512
4c9a546a78efbd6fa98a68dbe05e776128675767e5b562be117c3d309c1e28a0971b689305dd32c9bc53f07fa68136d3e18bc86eb60d6b4af2589a8b47d84424

Download Submit
memory/2200-28-0x0000000004350000-0x0000000004360000-memory.dmp

Filesize
64KB

Download
memory/2200-31-0x0000000004350000-0x0000000004360000-memory.dmp

Filesize
64KB

Download
memory/2200-30-0x0000000004350000-0x0000000004360000-memory.dmp

Filesize
64KB

Download
memory/2200-29-0x0000000004350000-0x0000000004360000-memory.dmp

Filesize
64KB

Download
memory/2200-33-0x0000000004350000-0x0000000004360000-memory.dmp

Filesize
64KB

Download
memory/2200-32-0x0000000004350000-0x0000000004360000-memory.dmp

Filesize
64KB

Download
memory/2200-43-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/2200-44-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-45-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-46-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-47-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-51-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-52-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-54-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-55-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-58-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-57-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-56-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-60-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-62-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-61-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-63-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-65-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-64-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-66-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-67-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-68-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-69-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-74-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-73-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/2200-72-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-71-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-70-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-75-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-76-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-77-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-78-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-79-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-81-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-80-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-84-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-83-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-82-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-85-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-86-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-90-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-89-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-88-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-87-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-92-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-91-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-93-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-94-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-95-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-96-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-97-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-98-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/2200-99-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-105-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download
memory/2200-104-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-103-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-102-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-101-0x0000000009210000-0x0000000009220000-memory.dmp

Filesize
64KB

Download
memory/2200-100-0x0000000007C10000-0x0000000007C20000-memory.dmp

Filesize
64KB

Download