Analysis

  • max time kernel
    127s
  • max time network
    130s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/11/2024, 10:22

General

  • Target

    Untitled song.mp3

  • Size

    1.5MB

  • MD5

    0a4db217c83b2473f2c5d40dd0e4ee11

  • SHA1

    bf0f75ce1429eb13a58c49eb4c200a69f541d942

  • SHA256

    09cc0f5dcac52cc34802f576363cdb915b939b3c39d47db1576d785425d4f2eb

  • SHA512

    b4dff3f683f18bc4f5a38079ba9d2ae446308d5d70c67c88eea4fcf67a60eb8546dd8346f4b305fe84c141e2ae045b42eb3cac2fb25781bcc7fb6a857e6942f7

  • SSDEEP

    24576:CnBDL07Wwt7hFXnwDnN98nPsN7qwR2HZsMEiff7TaaEwLqU52H51d5ECKDGq:CBDLjwfWesaH80TLEwLqU65H5ECkGq

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Untitled song.mp3"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:4776
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:2400
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x0000000000000480 0x00000000000004D0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1772
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4720

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

            Filesize

            256KB

            MD5

            1a0295014678e91e7fea0a79074d6ffc

            SHA1

            f93a33dfd19a09d92174a17f0912440ddb1479a0

            SHA256

            fba2e401545352472136e5c71b0596b9125ddcfe2b87c439d8567cb2dad16745

            SHA512

            d7aec99cf127bf009bad534f293b65ce93ed08c650312a32ea670b0cf09dcaa0906962d9b29ce6c078396885e8ce55bf5ae5598c2480fd508ebddd111bd6c882

          • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

            Filesize

            1024KB

            MD5

            33d8bdb6ed8b0aeb852a4c0b019555b2

            SHA1

            c2e08fbbbb63422faf76ba995022515836c469f4

            SHA256

            8208ca87ab830a8085b8f03e4a389633f721fabf0cdb669f47f34910199ac9f6

            SHA512

            f6b009e9653e9dcdfc18d398f6e1979061fe37a69e74aba8810916f8cb5577e74666db1634a62339b105f486eea62daed6ea6e1a0380d865175cf25bcf545d8e

          • C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

            Filesize

            68KB

            MD5

            2f30c9be4e7bbc7251e3b60cc7888b57

            SHA1

            d761cea74d57caccd159c20cca1c28c4a48f7c88

            SHA256

            31318405613b3a5e62aad31956448a14b501317bb2624474fe74d192acfa2d51

            SHA512

            f7bd32f6fb211c23fc394cf2247187f87aa916fb8fbac54115bbf05b2a061f5a605a1c588503261559597bde33ef157764e88d2bd0dd9dbff91543eb251c61e1

          • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

            Filesize

            9KB

            MD5

            7050d5ae8acfbe560fa11073fef8185d

            SHA1

            5bc38e77ff06785fe0aec5a345c4ccd15752560e

            SHA256

            cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

            SHA512

            a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

          • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

            Filesize

            1KB

            MD5

            f388dd54cd6d96d6303ba1a48bbdad93

            SHA1

            687b39a9b74fdab5f5574ccb1b32a1a1a2f66e68

            SHA256

            116d2fd1b8b3b117c736ea25f2c297ab299f66e5a697317391abc0b086fc98a3

            SHA512

            c8239984e0fca5049ef847558926faefd88dc0d294047a48f071afd4dd5f14af4a8e5cd2629fada38f65ddef2314949da5fef618ce6c45bd6956e68e0cd037ec

          • memory/4920-31-0x0000000004460000-0x0000000004470000-memory.dmp

            Filesize

            64KB

          • memory/4920-32-0x0000000004460000-0x0000000004470000-memory.dmp

            Filesize

            64KB

          • memory/4920-30-0x0000000004460000-0x0000000004470000-memory.dmp

            Filesize

            64KB

          • memory/4920-29-0x0000000004460000-0x0000000004470000-memory.dmp

            Filesize

            64KB

          • memory/4920-34-0x0000000004460000-0x0000000004470000-memory.dmp

            Filesize

            64KB

          • memory/4920-33-0x0000000004460000-0x0000000004470000-memory.dmp

            Filesize

            64KB

          • memory/4920-49-0x0000000004410000-0x0000000004420000-memory.dmp

            Filesize

            64KB

          • memory/4920-50-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-51-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-52-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-53-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-54-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-55-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-57-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-56-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-60-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-59-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-58-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-61-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-62-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-63-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-64-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-66-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-65-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-70-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-69-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-68-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-74-0x0000000004410000-0x0000000004420000-memory.dmp

            Filesize

            64KB

          • memory/4920-75-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-73-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-72-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-71-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-67-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-76-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-78-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-77-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-80-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-81-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-82-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-85-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-84-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-83-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-79-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-86-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-87-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-89-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-90-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-91-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-88-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-92-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-93-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-94-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-95-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-96-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-99-0x0000000004410000-0x0000000004420000-memory.dmp

            Filesize

            64KB

          • memory/4920-98-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-100-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-97-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-101-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB

          • memory/4920-102-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-103-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-105-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-104-0x00000000097A0000-0x00000000097B0000-memory.dmp

            Filesize

            64KB

          • memory/4920-106-0x0000000008C00000-0x0000000008C10000-memory.dmp

            Filesize

            64KB