4db65b59e92f19e54d336a19427230ec568cd8b26ea4601daa0681669ac3bc14

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Re-Logic - Terraria Soundtrack - 07 Jungle.mp3
Size

6.7MB
MD5

506075e369db736e92d2eab9180a307b
SHA1

411ad69306afec1b1777782924ebc0327469dc66
SHA256

5651685fded0761c7a923e796adcdc6c8ca7286ed4b5240e5ecc933677086c8b
SHA512

fa831f15e5843935113297ee8231e9e3bc276d64e8ca7c4940a6eeed4261e5119d607c066702e9099830dff6df9945d6d38c1c832386b16b640dff5051b6b4e9
SSDEEP

98304:3LBYMZry+OlsgTfTsS6IwNWzIAO0PL1xfLJmiF9HC8G1/pPcqlfl232go3:3LBUqgToI+A1D1NkSi3/pt4v8

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{F549104B-6846-49C4-B724-10F0CDC82F0E}	wmplayer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2288	wmplayer.exe
Token: SeCreatePagefilePrivilege	2288	wmplayer.exe
Token: SeShutdownPrivilege	876	unregmp2.exe
Token: SeCreatePagefilePrivilege	876	unregmp2.exe
Token: 33	2436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2436	AUDIODG.EXE
Token: SeShutdownPrivilege	2288	wmplayer.exe
Token: SeCreatePagefilePrivilege	2288	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	wmplayer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 4260	2288	wmplayer.exe	85
PID 2288 wrote to memory of 4260	2288	wmplayer.exe	85
PID 2288 wrote to memory of 4260	2288	wmplayer.exe	85
PID 4260 wrote to memory of 876	4260	unregmp2.exe	86
PID 4260 wrote to memory of 876	4260	unregmp2.exe	86

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Re-Logic - Terraria Soundtrack - 07 Jungle.mp3"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
063793e4ba784832026ec8bc3528f7f1

SHA1
687d03823d7ab8954826f753a645426cff3c5db4

SHA256
cb153cb703aea1ba1afe2614cffb086fa781646a285c5ac37354ee933a29cedd

SHA512
225910c24052dfdf7fca574b12ecef4eb68e990167010f80d7136f03ac6e7faa33233685cbf37b38ee626bb22ff3afeee39e597080e429be3ec241fb30af40c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
95995ef9f99397895fabb68e253bcf18

SHA1
c011916dc4eb89acde0dbb15343cc97f42d996d1

SHA256
bc3646098ca3124f9bb509b028be7eddba61e73704f785a365a1f8fa9b22174a

SHA512
43e0ec6be53c958cc23970f370bff1399c40753bf621f8b7e8ff08ebb917b9f6edc6e0c07a35e20b0a54537db136b8b4a126016d2bc91337859eadea3730df21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
c251d3ec64d1b69ce6e7647455f2f62e

SHA1
01df0c53dbbe30cdac0169fad802105cb9239c6e

SHA256
8df739dc2388c09b5442b18bc4722a6077a592cb37f9f025346ef6cd6d42220d

SHA512
9e56f5191a7a4664e9fee49f5c0af840a6793a7af9d02302df99bf6097bc44396457b4286fe82e12f49a5a7dc18f08dbb0a7426ecbaee68cd553337b8aedb817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
033369ae09c63adef095f2cf398938e7

SHA1
163c96aaba74f7643a6bc4d07276a7c15b420c98

SHA256
361617d4de11f7d17367653427dbad680fa77084fc9f9f879c994602d50ce452

SHA512
aecd95cabe1eedc2a0c0406a358ff1863404e764a46383df7dcd3581449c535556ec4b7161ff11aec58f94929d1122b319735c22ba78930bf3904e6ee8eed27e

Download Submit
memory/2288-28-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2288-29-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2288-31-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2288-30-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2288-33-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2288-32-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/2288-49-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/2288-50-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-51-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-53-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-52-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-54-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-55-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-57-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-56-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-58-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-60-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-59-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-61-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-63-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-64-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-65-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-66-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-62-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-67-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-68-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-69-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-70-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-73-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-72-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-74-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/2288-71-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-75-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-76-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-77-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-78-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-79-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-80-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-82-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-83-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-85-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-84-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-81-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-86-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-87-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-88-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-91-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-90-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-89-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-92-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-93-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-94-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-95-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-96-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-98-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-97-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-99-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/2288-100-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-101-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download
memory/2288-102-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-103-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-105-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-104-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/2288-106-0x0000000004C40000-0x0000000004C50000-memory.dmp

Filesize
64KB

Download