Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1379s -
max time network
1172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
Снимок экрана 2024-01-07 131427.mp4
Resource
win10v2004-20231215-en
3 signatures
1800 seconds
General
-
Target
Снимок экрана 2024-01-07 131427.mp4
-
Size
1.4MB
-
MD5
cb8885d07d1e6def99c5c6c76fbcd426
-
SHA1
a0abe9a0da08430025e212ec6f78c01e6945a55d
-
SHA256
6308445270f66b681639a22434e5f411541b0b62fc28bd615cb1d1b4d9a64bc4
-
SHA512
7b80b77f0575ef734420b2b6de0174c56a2f698cd338219766ad123e31c22617d1b829b2f31ecb3d07606ba651dc96b2ca99ad9f31d210ec128286c076764ff9
-
SSDEEP
24576:4/KIab7BizGXzhOUzGrGzGnaAE9zGpO0zG0UnaGzGpOzGiNlzGSTFzGSGDzGSC2o:4wbFizuxzpzZAE9z4hzfUnaGzLzXlztd
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 4572 unregmp2.exe Token: SeCreatePagefilePrivilege 4572 unregmp2.exe Token: SeManageVolumePrivilege 2368 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2216 wrote to memory of 512 2216 wmplayer.exe 43 PID 2216 wrote to memory of 512 2216 wmplayer.exe 43 PID 2216 wrote to memory of 512 2216 wmplayer.exe 43 PID 2216 wrote to memory of 2476 2216 wmplayer.exe 44 PID 2216 wrote to memory of 2476 2216 wmplayer.exe 44 PID 2216 wrote to memory of 2476 2216 wmplayer.exe 44 PID 2476 wrote to memory of 4572 2476 unregmp2.exe 45 PID 2476 wrote to memory of 4572 2476 unregmp2.exe 45
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Снимок экрана 2024-01-07 131427.mp4"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Снимок экрана 2024-01-07 131427.mp4"2⤵PID:512
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:2128
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368