Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3[ASL]_Fear...s].rar
windows7-x64
3[ASL]_Fear...s].rar
windows10-2004-x64
3[ASL] Fear...e.flac
windows7-x64
1[ASL] Fear...e.flac
windows10-2004-x64
6[ASL] Fear...n.flac
windows7-x64
1[ASL] Fear...n.flac
windows10-2004-x64
6[ASL] Fear...er.jpg
windows7-x64
1[ASL] Fear...er.jpg
windows10-2004-x64
3[ASL] Fear...01.jpg
windows7-x64
1[ASL] Fear...01.jpg
windows10-2004-x64
3[ASL] Fear...02.jpg
windows7-x64
1[ASL] Fear...02.jpg
windows10-2004-x64
3[ASL] Fear...03.jpg
windows7-x64
1[ASL] Fear...03.jpg
windows10-2004-x64
3[ASL] Fear...04.jpg
windows7-x64
1[ASL] Fear...04.jpg
windows10-2004-x64
3[ASL] Fear...05.jpg
windows7-x64
1[ASL] Fear...05.jpg
windows10-2004-x64
3[ASL] Fear...06.jpg
windows7-x64
1[ASL] Fear...06.jpg
windows10-2004-x64
3[ASL] Fear...07.jpg
windows7-x64
1[ASL] Fear...07.jpg
windows10-2004-x64
3[ASL] Fear...08.jpg
windows7-x64
1[ASL] Fear...08.jpg
windows10-2004-x64
3[ASL] Fear...09.jpg
windows7-x64
1[ASL] Fear...09.jpg
windows10-2004-x64
3[ASL] Fear...e!.url
windows7-x64
1[ASL] Fear...e!.url
windows10-2004-x64
1[ASL] Fear...se.nfo
windows7-x64
1[ASL] Fear...se.nfo
windows10-2004-x64
1Analysis
-
max time kernel
136s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 14:23
Behavioral task
behavioral1
Sample
[ASL]_Fear_and_Loathing_in_Las_Vegas_-_Hunter_x_Hunter_ED_-_Just_Awake_[FLAC]_[w_Scans].rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
[ASL]_Fear_and_Loathing_in_Las_Vegas_-_Hunter_x_Hunter_ED_-_Just_Awake_[FLAC]_[w_Scans].rar
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/01 Just Awake.flac
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/01 Just Awake.flac
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/02 Break Out Your Stained Brain.flac
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/02 Break Out Your Stained Brain.flac
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Cover.jpg
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Cover.jpg
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0001.jpg
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0001.jpg
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0002.jpg
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0002.jpg
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0003.jpg
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0003.jpg
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0004.jpg
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0004.jpg
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0005.jpg
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0005.jpg
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0006.jpg
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0006.jpg
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0007.jpg
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0007.jpg
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0008.jpg
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0008.jpg
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0009.jpg
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Scans/JustAwake_0009.jpg
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Visit anime-sharing.com for more!.url
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/Visit anime-sharing.com for more!.url
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/release.nfo
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/release.nfo
Resource
win10v2004-20240412-en
General
-
Target
[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]/01 Just Awake.flac
-
Size
28.6MB
-
MD5
0641ce248cb2cec6c6af3e69d3011db8
-
SHA1
66222aa4eaa7532b16b101615002299302c5839d
-
SHA256
284a139f4f3df57b47f570b33e49cdba3d2463757b8e4e1f7f2552c4b1504374
-
SHA512
f317ec57fe4b3a776d7881086954e64fbfa5042da7070a4e1d92bc520c5e1fa73e05a6f413f60ae28a3c756a8c5b2cc38ded01e537d5713958cea8b76b2de257
-
SSDEEP
393216:ONwB5RtBCHXM2HXseAENHRv2DSpz2IiszjWoal3plAprAI9tRcf1+jY2Wdw3qlPd:OwC3B3cuvESpKIFXalwTGYjVWdwa1Pvd
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3396 unregmp2.exe Token: SeCreatePagefilePrivilege 3396 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4580 wrote to memory of 816 4580 wmplayer.exe 84 PID 4580 wrote to memory of 816 4580 wmplayer.exe 84 PID 4580 wrote to memory of 816 4580 wmplayer.exe 84 PID 4580 wrote to memory of 5052 4580 wmplayer.exe 85 PID 4580 wrote to memory of 5052 4580 wmplayer.exe 85 PID 4580 wrote to memory of 5052 4580 wmplayer.exe 85 PID 5052 wrote to memory of 3396 5052 unregmp2.exe 86 PID 5052 wrote to memory of 3396 5052 unregmp2.exe 86
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]\01 Just Awake.flac"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[ASL] Fear, and Loathing in Las Vegas - Hunter x Hunter ED - Just Awake [FLAC] [w Scans]\01 Just Awake.flac"2⤵PID:816
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5987a07b978cfe12e4ce45e513ef86619
SHA122eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA256f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
SHA51239b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD51839efd18c5eacd09d223bcf6dd2b6a1
SHA1780ed8f97b6f278d76d06a444a24519749c83abd
SHA2567ab8cf43d6f027aa26bd90cf84b77dd2ce2a2fba82691e96f45fea54ded5a55c
SHA51218cab89a0bdd5263764014a62bc623d9e0da0c320f15f637614f7e270bcb809a60b24cd46c4f477155ebd3f85ef373eda88d766af56114e5d917b377a7017574