Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2023, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
8c3cdb618b0abcc819c9879773d231e5.mp4
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8c3cdb618b0abcc819c9879773d231e5.mp4
Resource
win10v2004-20230220-en
General
-
Target
8c3cdb618b0abcc819c9879773d231e5.mp4
-
Size
2.3MB
-
MD5
b44a8e7be11ab04077d05e276433209d
-
SHA1
27723d2c5a67a30e770c6a97ee3eefefe0518c3a
-
SHA256
ff4bd330610c28a3da19bc0cb5fb77e3970b18ad563721a8b4b06f42657f2f5d
-
SHA512
b3295d0b4167dd7e5bcc1e7b6a93867e8c7e0942f12bdde8573ad025d590f9a9b43b2f6279cd49194d5e7b4f7080528168cccb4e9b94e0715a19938422f4e46b
-
SSDEEP
49152:b2yneuPM8vBnNNWijrXM4dnv/lp13xMjv+ZfSP3FI9s:3PZaijA4dn860a9s
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1636 unregmp2.exe Token: SeCreatePagefilePrivilege 1636 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1200 wrote to memory of 3428 1200 wmplayer.exe 84 PID 1200 wrote to memory of 3428 1200 wmplayer.exe 84 PID 1200 wrote to memory of 3428 1200 wmplayer.exe 84 PID 1200 wrote to memory of 1780 1200 wmplayer.exe 85 PID 1200 wrote to memory of 1780 1200 wmplayer.exe 85 PID 1200 wrote to memory of 1780 1200 wmplayer.exe 85 PID 1780 wrote to memory of 1636 1780 unregmp2.exe 86 PID 1780 wrote to memory of 1636 1780 unregmp2.exe 86
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\8c3cdb618b0abcc819c9879773d231e5.mp4"1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\8c3cdb618b0abcc819c9879773d231e5.mp4"2⤵PID:3428
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5dbfc662304aa4236ac6c685fdd3ee597
SHA1bee96b9256c93a35398a8c6a341da9470c6101c2
SHA256dfd76fd8ae4d04c006729be160e7c23fe8e003e7094a54abf3a5aaee1a5c5590
SHA5126730c50e8217e93d819b24a76af50ed9afeb34c73f32bcf65cca1bac139219c4897f7a43faa7a88909b32777420f47beb2a1ab23fad5886ef4da35226305c42b
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD53dc9a40a03a9e26864ea69a3904b18a2
SHA161cd8321218f88d32941293038d4067d0ae76207
SHA256e0cae13ab3deb04118ee67abc1b3855006863f05536354cb3e0e7781f6a2d53b
SHA5126ca73d9344088fd49f4b2aadc790a2de0daaa8882f4cbb8cada40750d8b847c7c9dda8b1693afa159d66baded96bb9ab44069e0d4e0bd07ca23fefda1ce9f248