Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2023, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
hd-acceleracers-with-battle-force-5-theme-song.mp4
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
hd-acceleracers-with-battle-force-5-theme-song.mp4
Resource
win10v2004-20230220-en
General
-
Target
hd-acceleracers-with-battle-force-5-theme-song.mp4
-
Size
17.7MB
-
MD5
76ae30e1ddc27325d7e516ef789ca1af
-
SHA1
f4474d21f24caf606af6a6c52c5741868abcff82
-
SHA256
dc9eccc04bfb90e12ae05a2ed6d50707a1182f20b23f581eabf03d47c8e98db1
-
SHA512
99cc89bf4fc65c16efe352fecbae9c60c1f46abe3ab159ada2096cfcd00989fd3699ce15c1c6c7ee91086db77324bca021c2223797293aa57f95d2da4cd59ae5
-
SSDEEP
393216:/OWILMh4hyHvfazQorx8fjSqbys0nY31o9kwck9i3bWqfEKV1r:2WgM6Zrxy5ysQY31om9Frbf3
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 396 unregmp2.exe Token: SeCreatePagefilePrivilege 396 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3012 wrote to memory of 1556 3012 wmplayer.exe 84 PID 3012 wrote to memory of 1556 3012 wmplayer.exe 84 PID 3012 wrote to memory of 1556 3012 wmplayer.exe 84 PID 3012 wrote to memory of 4568 3012 wmplayer.exe 85 PID 3012 wrote to memory of 4568 3012 wmplayer.exe 85 PID 3012 wrote to memory of 4568 3012 wmplayer.exe 85 PID 4568 wrote to memory of 396 4568 unregmp2.exe 86 PID 4568 wrote to memory of 396 4568 unregmp2.exe 86
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\hd-acceleracers-with-battle-force-5-theme-song.mp4"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\hd-acceleracers-with-battle-force-5-theme-song.mp4"2⤵PID:1556
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD52936527c6171be1065c6012a3e8ffddd
SHA19273557d3cfc6987eac30802569e9d2579d7d4a4
SHA256e341ab7fd265205d2477cb5234a6c3d35911d7ebb17139b585b55eb7def237e0
SHA512a83203b4696232299c70ff0f7ae292964417b0636d278544fd252a41e6ab3b5c749e836d83d7b22bc52d56dc069bb8caa0ebf5634b32e3acae7afc87c1215e5d
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD58975c69b85be55771227fc9f8e3b25f8
SHA1548581f9d79ae7d94f3b38c65f4efd202bb9bd48
SHA25673815f23252b6cba7bd122ea5685add8828895f92d89e500888f95ab122a0ef5
SHA5123e074f91bb6b165bd82aa9518c2ba7b5d447f9d333664885716ab5ccdec4627faf80230cb4826a643053efaba599e2da7aa170df09c02f9552db653daf930dc0