8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Size

64KB
MD5

d098ed5d12ec03c894ce42da6e38c2d6
SHA1

2e2a54824aba72e90d634d255999b2eee9503306
SHA256

8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b
SHA512

5b9df34ad34cc2f9d46580654144008976124c00752c95d3adbe275159de1d06a4077658fc42846590511947d0fdef4f9372c36196eb2759b56891eaaa03842f
SSDEEP

1536:9VB9ew1O/1hhDiZnHba3W74s3KdWGGZttlI6TRqnouy8hyG+jKY:9Ve1fh8nHbao6dWntI6TRyouthyLv

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "rundll32.exe"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "rundll32.exe"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "rundll32.exe"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Executes dropped EXE 3 IoCs

pid	Process
2844	svchost.exe
4844	wmplayerc.exe
2232	svchost.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\lnkfile\ = "File Folder"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Media Player = "C:\\Program Files (x86)\\Windows Media Player\\wmplayerc.exe"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Documents\RÊCYCLÊR\desktop.ini	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened for modification	F:\RÊCYCLÊR\desktop.ini	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\RÊCYCLÊR\desktop.ini	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\X:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\U:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\R:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\Y:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\S:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\E:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\N:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\P:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\Z:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\K:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\M:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\T:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\H:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\Q:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\W:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\J:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\L:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\I:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\V:	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Autorun.inf	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened for modification	F:\Autorun.inf	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayerc.exe	wmplayerc.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\svchost.exe	wmplayerc.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayerc.exe	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayerc.exe	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\svchost.exe	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayerc.exe	wmplayerc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayerc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1180	taskkill.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\AutoEndTasks = "1"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\HungAppTimeout = "111"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\WaitToKillAppTimeout = "111"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\lnkfile\ = "File Folder"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4844	wmplayerc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeShutdownPrivilege	1696	unregmp2.exe
Token: SeCreatePagefilePrivilege	1696	unregmp2.exe
Token: SeShutdownPrivilege	4892	wmplayer.exe
Token: SeCreatePagefilePrivilege	4892	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4892	wmplayer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	svchost.exe
2232	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2844	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	82
PID 3124 wrote to memory of 2844	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	82
PID 3124 wrote to memory of 2844	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	82
PID 3124 wrote to memory of 4892	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	83
PID 3124 wrote to memory of 4892	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	83
PID 3124 wrote to memory of 4892	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	83
PID 4892 wrote to memory of 4596	4892	wmplayer.exe	84
PID 4892 wrote to memory of 4596	4892	wmplayer.exe	84
PID 4892 wrote to memory of 4596	4892	wmplayer.exe	84
PID 3124 wrote to memory of 1180	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	85
PID 3124 wrote to memory of 1180	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	85
PID 3124 wrote to memory of 1180	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	85
PID 3124 wrote to memory of 4844	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	86
PID 3124 wrote to memory of 4844	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	86
PID 3124 wrote to memory of 4844	3124	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe	86
PID 4596 wrote to memory of 1696	4596	unregmp2.exe	88
PID 4596 wrote to memory of 1696	4596	unregmp2.exe	88
PID 4844 wrote to memory of 2232	4844	wmplayerc.exe	90
PID 4844 wrote to memory of 2232	4844	wmplayerc.exe	90
PID 4844 wrote to memory of 2232	4844	wmplayerc.exe	90

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe

C:\Users\Admin\AppData\Local\Temp\8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe
"C:\Users\Admin\AppData\Local\Temp\8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Modifies system executable filetype association
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3124
- C:\Program Files (x86)\Windows Media Player\svchost.exe
  "C:\Program Files (x86)\Windows Media Player\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2844
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:1696
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im "8f5c02636a6977ae7045a1325c005b8f76897678320dd84a2ea1d2458a5a530b.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Program Files (x86)\Windows Media Player\wmplayerc.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayerc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Windows Media Player\svchost.exe
    "C:\Program Files (x86)\Windows Media Player\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\svchost.exe

Filesize
9KB

MD5
a3565eec669697a3d6f7b35fb75fcb26

SHA1
6e81f83c057ff5da8f800a23f32f717a3e0ca2dc

SHA256
a7e6bd8d46e6eb541a071fb8a94b9567ecbb1c353764e36fae8b6f41b4a3d1d5

SHA512
0f815447afd11be56e49455bb4246b6e31063ae5f72743109a644d4d0fb0c79e78cf7b9bf17b19684fba25a72a66b2e4ad6a481871ae6792472a9e9942a20032

Download Submit
C:\Program Files (x86)\Windows Media Player\wmplayerc.exe

Filesize
64KB

MD5
c3fe1a00aeda2c021089b3a19a4fe654

SHA1
17ac72516bb4893aa700583b8504d1c2b789d8b8

SHA256
2bea2c14cc9d15a0d28ddae02698005bbead2bfdde531aa6b74f19c56b76bfec

SHA512
bdc257c329a322bb8be6a48efb5512b748de06a8e1292fa769c13eb40285b8e0400dc14208eeebbd76e3a44df22a81d5004b083fefdcfd35cbe5db4325026d02

Download Submit
C:\RÊCYCLÊR\desktop.ini

Filesize
65B

MD5
ad0b0b4416f06af436328a3c12dc491b

SHA1
743c7ad130780de78ccbf75aa6f84298720ad3fa

SHA256
23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416

SHA512
884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56

Download Submit
C:\RÊCYCLÊR\ .com

Filesize
64KB

MD5
584ce8bcd32e8151fdcef49313bf4403

SHA1
854a02c7ea29db78c3fd549777f491f2d6ea903a

SHA256
4ffc358c469505d71ff8256c5d3bb24a662a600bee8cc94dc04e4d80f74d0092

SHA512
1e2289922c5285b8ae954e62fa0bbd9bc163e4e766cc2d62149c2fcfd6a20c8f41cac0477547752c2a9a642fcac09b83f90e142ce63605254bf5f28663a8b1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
adbd8353954edbe5e0620c5bdcad4363

SHA1
aeb5c03e8c1b8bc5d55683ea113e6ce1be7ac6e6

SHA256
64eff10c4e866930d32d4d82cc88ec0e6f851ac49164122cae1b27eb3c9d9d55

SHA512
87bf4a2dc4dd5c833d96f3f5cb0b607796414ffee36d5c167a75644bcbb02ab5159aa4aa093ed43abe290481abc01944885c68b1755d9b2c4c583fcccd041fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
fd3d35b56e67455f537b1bfd52e3154e

SHA1
876b9e22e00f7ef42d6e4117833a0fd753011ed5

SHA256
a0f05d0321cac2581d514550bc2b06c25c48474046357095761eb6789550ed53

SHA512
8b45fee5767ba8679bf1dd128a83dd6b834357a5e9b0cf7f5bb63f82ddaf8b4a21de22bea6e1dd4d45a0cff2dda9c1cf8d34326caf4f1f92747978a4100e2866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
b6152fd05e7492f02c7d69bbb97217ae

SHA1
0441519e0bae1d0356233664d98d8cbc59dcbcb4

SHA256
cf3fabefffc7b733cc43c890c1f334b8318ca11c513dc6e19c79e316fd914479

SHA512
4262ce9cb9e2b8e6cbe989ff685167b4e73b58739d7ff9130838f6440a09f8d8f89ea28f40049f3b726fb1f2dd775e0ae4c3f57732ba34443fc7b2d973a51a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\XY2U05L9.htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
2c9df336b981246269115c8a4dba356d

SHA1
e4682fc0fc37e956710e0adf155623ce982e870d

SHA256
2e05949aa3e454b1a78c11f3f96762d0cfef69a988cc60bad30b68daebdbb16f

SHA512
b08c5feb93e7dc131502e77b67683c4fcf3cc098c25b8071e1aeb25d1eeb76e1d2099ffbfbd14924faf3c4681f034da95c3d3d69456e4b783d72357a56e7b129

Download Submit
memory/2232-153-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2844-173-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2844-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3124-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3124-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4844-123-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4844-315-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4892-201-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-210-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-179-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-180-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-183-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-182-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-181-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-184-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-186-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-185-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-188-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-189-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-190-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-192-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-191-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-193-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-194-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-196-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-195-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-197-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-200-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-177-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-202-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/4892-199-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-203-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-204-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-205-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-206-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-207-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-208-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-209-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-178-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-211-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-213-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-212-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-214-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-215-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-219-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-218-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-217-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-216-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-220-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-221-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-223-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-224-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-226-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-228-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-227-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-229-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/4892-231-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-233-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-234-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-235-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-236-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-237-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-238-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-239-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/4892-241-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-240-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-176-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/4892-174-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads