| File name: | image004.wmz |
| Full analysis: | https://app.any.run/tasks/dbfc0370-15bb-429a-b4dc-d968ad3c55ee |
| Verdict: | Malicious activity |
| Analysis date: | November 14, 2022, 06:40:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/gzip |
| File info: | gzip compressed data, max speed, from NTFS filesystem (NT), original size modulo 2^32 95456 |
| MD5: | 37B90F5B8406A688346AF81529EC3797 |
| SHA1: | ED7642C97B29EA216640CF53D4FEA99D70FCB4FE |
| SHA256: | 5BAAE0568AA8D2B37A3567D55B6A11CCFB090BA006B17DBCCDC3CA9C0C73F5EE |
| SSDEEP: | 192:hsj5fWKGfgFbi/jjTQ2Z4vHWjF+NfQFH85YYL+7+HOn+:8wfqajgJfWjFIq8OteOn+ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads Internet Settings
- wmplayer.exe (PID: 3864)
- setup_wm.exe (PID: 1336)
- wmplayer.exe (PID: 2228)
Checks Windows Trust Settings
- setup_wm.exe (PID: 1336)
Reads security settings of Internet Explorer
- setup_wm.exe (PID: 1336)
- wmplayer.exe (PID: 2228)
Reads settings of System Certificates
- setup_wm.exe (PID: 1336)
Reads Microsoft Outlook installation path
- wmplayer.exe (PID: 2228)
Reads Internet Explorer settings
- wmplayer.exe (PID: 2228)
INFO
Checks supported languages
- wmplayer.exe (PID: 3864)
- setup_wm.exe (PID: 1336)
- wmplayer.exe (PID: 2228)
Process checks LSA protection
- wmplayer.exe (PID: 3864)
- setup_wm.exe (PID: 1336)
- wmplayer.exe (PID: 2228)
Reads the computer name
- wmplayer.exe (PID: 3864)
- setup_wm.exe (PID: 1336)
- wmplayer.exe (PID: 2228)
Reads Environment values
- setup_wm.exe (PID: 1336)
Reads the machine GUID from the registry
- setup_wm.exe (PID: 1336)
- wmplayer.exe (PID: 2228)
Process checks computer location settings
- setup_wm.exe (PID: 1336)
- wmplayer.exe (PID: 2228)
Creates a file in a temporary directory
- setup_wm.exe (PID: 1336)
Creates files in the user directory
- wmplayer.exe (PID: 2228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .z/gz/gzip | | | GZipped data (100) |
|---|
Total processes
39
Monitored processes
5
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1336 | "C:\Program Files\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files\Windows Media Player\wmplayer.exe" /layout:"C:\Users\admin\AppData\Local\Temp\Rar$DIa3440.19890\image004.wmz" | C:\Program Files\Windows Media Player\setup_wm.exe | — | wmplayer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Media Configuration Utility Exit code: 1 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2228 | "C:\Program Files\Windows Media Player\wmplayer.exe" /Relaunch /layout:"C:\Users\admin\AppData\Local\Temp\Rar$DIa3440.19890\image004.wmz" | C:\Program Files\Windows Media Player\wmplayer.exe | setup_wm.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Exit code: 0 Version: 12.0.7601.23517 (win7sp1_ldr.160812-0732) Modules
| |||||||||||||||
| 3424 | C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary | C:\Windows\system32\unregmp2.exe | — | setup_wm.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Media Player Setup Utility Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3440 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\image004.wmz.z" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3864 | "C:\Program Files\Windows Media Player\wmplayer.exe" /layout:"C:\Users\admin\AppData\Local\Temp\Rar$DIa3440.19890\image004.wmz" | C:\Program Files\Windows Media Player\wmplayer.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Exit code: 0 Version: 12.0.7601.23517 (win7sp1_ldr.160812-0732) Modules
| |||||||||||||||
Total events
7 183
Read events
6 960
Write events
220
Delete events
3
Modification events
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\image004.wmz.z | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3440) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
0
Suspicious files
3
Text files
16
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2228 | wmplayer.exe | C:\Users\Public\Music\Sample Music\AlbumArtSmall.jpg | — | |
MD5:— | SHA256:— | |||
| 2228 | wmplayer.exe | C:\Users\Public\Music\Sample Music\Folder.jpg | — | |
MD5:— | SHA256:— | |||
| 2228 | wmplayer.exe | C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg | — | |
MD5:— | SHA256:— | |||
| 2228 | wmplayer.exe | C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg | — | |
MD5:— | SHA256:— | |||
| 3440 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa3440.19890\image004.wmz | image | |
MD5:— | SHA256:— | |||
| 2228 | wmplayer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TZOZTO99GQRX4GBDQSCI.temp | binary | |
MD5:— | SHA256:— | |||
| 1336 | setup_wm.exe | C:\Users\admin\AppData\Local\Temp\wmsetup.log | text | |
MD5:— | SHA256:— | |||
| 2228 | wmplayer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 3424 | unregmp2.exe | C:\Users\admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdb | binary | |
MD5:3B8E4FAD2454F5CF97B5B401A8369E91 | SHA256:A69C8FB196478BF95A1C0AF91E67F7CFA5E7828DB8D0FEC22F5F47E108A237D5 | |||
| 2228 | wmplayer.exe | C:\Users\admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0002DBFE\10_All_Music.wpl | html | |
MD5:51AEED11707741118E0706C1259DF22E | SHA256:EC286113E5AD77AC34063589A137A6DC4B4CAB8845CD9C5386519983FA3B48F0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
2
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2228 | wmplayer.exe | GET | 302 | 2.16.241.11:80 | http://redir.metaservices.microsoft.com/redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.24499&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2228 | wmplayer.exe | 2.16.241.11:80 | redir.metaservices.microsoft.com | Akamai International B.V. | DE | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
redir.metaservices.microsoft.com |
| whitelisted |
toc.music.metaservices.microsoft.com |
| whitelisted |