Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/01/2024, 10:54

240108-mzzmpahba3 6

08/01/2024, 10:53

240108-my7lxagcbn 6

Analysis

  • max time kernel
    1379s
  • max time network
    1172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2024, 10:54

General

  • Target

    Снимок экрана 2024-01-07 131427.mp4

  • Size

    1.4MB

  • MD5

    cb8885d07d1e6def99c5c6c76fbcd426

  • SHA1

    a0abe9a0da08430025e212ec6f78c01e6945a55d

  • SHA256

    6308445270f66b681639a22434e5f411541b0b62fc28bd615cb1d1b4d9a64bc4

  • SHA512

    7b80b77f0575ef734420b2b6de0174c56a2f698cd338219766ad123e31c22617d1b829b2f31ecb3d07606ba651dc96b2ca99ad9f31d210ec128286c076764ff9

  • SSDEEP

    24576:4/KIab7BizGXzhOUzGrGzGnaAE9zGpO0zG0UnaGzGpOzGiNlzGSTFzGSGDzGSC2o:4wbFizuxzpzZAE9z4hzfUnaGzLzXlztd

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Снимок экрана 2024-01-07 131427.mp4"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Снимок экрана 2024-01-07 131427.mp4"
      2⤵
        PID:512
      • C:\Windows\SysWOW64\unregmp2.exe
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
          3⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:4572
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:2128
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2368

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2368-49-0x000001A940C40000-0x000001A940C50000-memory.dmp

        Filesize

        64KB

      • memory/2368-33-0x000001A940B40000-0x000001A940B50000-memory.dmp

        Filesize

        64KB

      • memory/2368-65-0x000001A9491B0000-0x000001A9491B1000-memory.dmp

        Filesize

        4KB

      • memory/2368-66-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-68-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-72-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-71-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-74-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-75-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-73-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-70-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-69-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-67-0x000001A9491E0000-0x000001A9491E1000-memory.dmp

        Filesize

        4KB

      • memory/2368-77-0x000001A948DF0000-0x000001A948DF1000-memory.dmp

        Filesize

        4KB

      • memory/2368-76-0x000001A948E00000-0x000001A948E01000-memory.dmp

        Filesize

        4KB

      • memory/2368-79-0x000001A948E00000-0x000001A948E01000-memory.dmp

        Filesize

        4KB

      • memory/2368-82-0x000001A948DF0000-0x000001A948DF1000-memory.dmp

        Filesize

        4KB

      • memory/2368-85-0x000001A9405F0000-0x000001A9405F1000-memory.dmp

        Filesize

        4KB

      • memory/2368-101-0x000001A949050000-0x000001A949051000-memory.dmp

        Filesize

        4KB

      • memory/2368-100-0x000001A948F40000-0x000001A948F41000-memory.dmp

        Filesize

        4KB

      • memory/2368-99-0x000001A948F40000-0x000001A948F41000-memory.dmp

        Filesize

        4KB

      • memory/2368-97-0x000001A948F30000-0x000001A948F31000-memory.dmp

        Filesize

        4KB