Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/05/2023, 15:06
230524-sg7hgada72 605/05/2023, 19:51
230505-yk45eaag22 105/05/2023, 19:47
230505-yhzf5sce61 605/05/2023, 19:44
230505-yf7dzaac46 605/05/2023, 19:37
230505-yb75psca8t 605/05/2023, 19:34
230505-x989zsbg8y 605/05/2023, 19:33
230505-x9hr2ahf39 605/05/2023, 18:11
230505-wsxn7aea5s 605/05/2023, 17:09
230505-vpajtabe99 6Analysis
-
max time kernel
153s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4
Resource
win10v2004-20230220-en
General
-
Target
df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4
-
Size
165KB
-
MD5
f5eafcc303576a4344588304f9a0cabd
-
SHA1
dedec3c11406d0356d9c5ea487f39306b95e29d5
-
SHA256
ddbbf34580df55639d25c93409532171c3d4230a7609d5909e1bff1f29979cb0
-
SHA512
502d52cc58fd3d65f4f71e1f220be45a235710a3dc1dd6514c39dff348395e1cc63672b7030b540eb172d50cc5e0be8882080552b981daef2b2df00eaba6c459
-
SSDEEP
3072:2YOSb2U5+6v3Bzq0OCj91PMYi0BsRFBlgo1NaCPl/VhfvAgedFSrK:MSY6v3B2yR1UYzsRFbgouO/jKFQK
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1112 unregmp2.exe Token: SeCreatePagefilePrivilege 1112 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2816 wrote to memory of 1116 2816 wmplayer.exe 84 PID 2816 wrote to memory of 1116 2816 wmplayer.exe 84 PID 2816 wrote to memory of 1116 2816 wmplayer.exe 84 PID 2816 wrote to memory of 2216 2816 wmplayer.exe 85 PID 2816 wrote to memory of 2216 2816 wmplayer.exe 85 PID 2816 wrote to memory of 2216 2816 wmplayer.exe 85 PID 2216 wrote to memory of 1112 2216 unregmp2.exe 86 PID 2216 wrote to memory of 1112 2216 unregmp2.exe 86
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4"1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4"2⤵PID:1116
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5fc240c081ec382df4b74d591d7d37a45
SHA1396e9d8accb2ff8b32e6c3957808cb87d23ad47c
SHA2568cfeb277627a0fc9f2596c83dc37f9a3d8871293cd88dadd08f32098bf936038
SHA512d8f83773c330b88b43f9ebc6220aa98368854e44a75b73a8575e7171f6c32e784d404e5a2e2e7787d3c71c0cfecdbb983631b639d9fee879b374d498d2ef0ab7
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD5ec1c0d22906adda8bec24213649ad406
SHA106b7b3c4aa33a2d433db8d15097befe56ac490c5
SHA2567c3869516f3f092520fe876de38f97789a00f7d652ebab60c768282371916ea9
SHA51244891195ecbb38b2582d61c8792c244446ad06db3436b86a95f7f11f5bfd8ad18ce22e36939e7edf9efb7e639c07d0027613275520b441c4bf3f89d6071bab5d