Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/05/2023, 15:06
230524-sg7hgada72 605/05/2023, 19:51
230505-yk45eaag22 105/05/2023, 19:47
230505-yhzf5sce61 605/05/2023, 19:44
230505-yf7dzaac46 605/05/2023, 19:37
230505-yb75psca8t 605/05/2023, 19:34
230505-x989zsbg8y 605/05/2023, 19:33
230505-x9hr2ahf39 605/05/2023, 18:11
230505-wsxn7aea5s 605/05/2023, 17:09
230505-vpajtabe99 6Analysis
-
max time kernel
225s -
max time network
291s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4
Resource
win10v2004-20230221-en
General
-
Target
df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4
-
Size
165KB
-
MD5
f5eafcc303576a4344588304f9a0cabd
-
SHA1
dedec3c11406d0356d9c5ea487f39306b95e29d5
-
SHA256
ddbbf34580df55639d25c93409532171c3d4230a7609d5909e1bff1f29979cb0
-
SHA512
502d52cc58fd3d65f4f71e1f220be45a235710a3dc1dd6514c39dff348395e1cc63672b7030b540eb172d50cc5e0be8882080552b981daef2b2df00eaba6c459
-
SSDEEP
3072:2YOSb2U5+6v3Bzq0OCj91PMYi0BsRFBlgo1NaCPl/VhfvAgedFSrK:MSY6v3B2yR1UYzsRFbgouO/jKFQK
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1272 unregmp2.exe Token: SeCreatePagefilePrivilege 1272 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1412 wrote to memory of 1088 1412 wmplayer.exe 79 PID 1412 wrote to memory of 1088 1412 wmplayer.exe 79 PID 1412 wrote to memory of 1088 1412 wmplayer.exe 79 PID 1412 wrote to memory of 1304 1412 wmplayer.exe 80 PID 1412 wrote to memory of 1304 1412 wmplayer.exe 80 PID 1412 wrote to memory of 1304 1412 wmplayer.exe 80 PID 1304 wrote to memory of 1272 1304 unregmp2.exe 81 PID 1304 wrote to memory of 1272 1304 unregmp2.exe 81
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4"1⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\df4brk2-5f3486a6-6e7e-42e1-a5b1-1b419ef75c9a.mp4"2⤵PID:1088
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5dbfc662304aa4236ac6c685fdd3ee597
SHA1bee96b9256c93a35398a8c6a341da9470c6101c2
SHA256dfd76fd8ae4d04c006729be160e7c23fe8e003e7094a54abf3a5aaee1a5c5590
SHA5126730c50e8217e93d819b24a76af50ed9afeb34c73f32bcf65cca1bac139219c4897f7a43faa7a88909b32777420f47beb2a1ab23fad5886ef4da35226305c42b
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD5c6324ae4c352d398117627eaeec0bdd6
SHA1df86dfb7863dbc3a1b90e64b141af93a952c1cc9
SHA2563c8c0b9b3930d608d55ffdc767e99896d555a04878706f4ee7ba46fdea22fa3c
SHA512cf7414eab462633ef82e9a3c2920fefdfd9f62ef2328715fa67d346ffdc93fbb5030079deadca009669881d18f93e6dfc47bccd80879481696e44d1475684a53