Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/04/2024, 12:14

240428-peeswsfe43 8

Analysis

  • max time kernel
    7s
  • max time network
    9s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/04/2024, 12:14

General

  • Target

    ETERNA.mp3

  • Size

    5.6MB

  • MD5

    ed383636189f35f157fcbb1239b0caff

  • SHA1

    412b0a75394b19fa8d6381b0f90f5f6d79c2582c

  • SHA256

    5827b8f87c888fa2666fa195574f614ef9870d1480b590906e336ea3338ad893

  • SHA512

    b3b30cc49dfbb69ee225d239a91a7aac58c2439ab9493021dc410396fd4bbbaec690639f6e9c2eefb2992554f7d5d52731e55bab1cce7eb6a71ce4ca6d240af5

  • SSDEEP

    98304:vezC2BgaPB8jkMNBRuTDYb2DYeVO8cXZLbb2rpM0+ZIU4jEvKG:vuBF+jrMYbe1cpLbq1MfbMdG

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\ETERNA.mp3"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\ETERNA.mp3"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\SysWOW64\unregmp2.exe
        C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
          4⤵
          • Modifies Installed Components in the registry
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          • Modifies registry class
          PID:4032
      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\ETERNA.mp3"
        3⤵
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3000
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:1536
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:4324
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    64KB

    MD5

    19d78b1eae63fd95e33c36ae0cad7aa8

    SHA1

    52bbbd1abf5e05fd11b19462a54685e7ccfc2d4b

    SHA256

    50c2e86388d63a5a5a2052f9866083e8784c3eed266f9b947b4f5772e5fbcf80

    SHA512

    34d6dd06fc41e2a3bf026cc58e461cf12064eab6969225d118b786aaacfabaac8bd7cbc6c26ad2c985faa04f0a07a4134119d4780c9189ded6db3d0fe9b59454

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    1024KB

    MD5

    61fe81b2e20b44b8c933046008edf13a

    SHA1

    1665840e8c9b9264c168454f0b5f6d239bd2e130

    SHA256

    2d51920af2fface79143d0565c68a76655644820281bea28678d89a260083e65

    SHA512

    17fa3f7e4284ca6d3bedb7be2515c47afe213661be10f273f9fd6efad444d6ccf3fe93967ed2705b745711ffe129408126e45cdc2e4a47ffd957a391334519ca

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    1KB

    MD5

    8aa54b08f6f1137e5fbabe1164a2766d

    SHA1

    424a652f136c7abb499851b5667440dc8875765a

    SHA256

    0304dfbfbfce67e157abac4279bba86bf4f2c565f89eaec4e8645abc858b4d5d

    SHA512

    15f9828c82384f27697b17a3c897341b1d8979dc8979a2308e86f79ae9e3ba82061644b73ebfdcb729fc74370adb10ff1b15929729adf890438d86e4ba650be2

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    2KB

    MD5

    3f9326f5b7b8a6ca1360687cd1272ef8

    SHA1

    dffdd9c6f65398d925bcf2664dac5c92d4e6b273

    SHA256

    e1a3119608114cdfff510be982eb5ba7948c17001f591ad67289d70d41347ccc

    SHA512

    5acba8917e66e305827c6f6f2aba783ac736d3a35fef0647113ecc810c6c91a14fb7539b31191d107133b016c37ea8065ac51afefe421230e075c1906445b608

  • memory/3000-45-0x0000000003B60000-0x0000000003B70000-memory.dmp

    Filesize

    64KB

  • memory/3000-46-0x0000000003B60000-0x0000000003B70000-memory.dmp

    Filesize

    64KB

  • memory/3000-44-0x0000000003B60000-0x0000000003B70000-memory.dmp

    Filesize

    64KB

  • memory/3000-43-0x0000000003B60000-0x0000000003B70000-memory.dmp

    Filesize

    64KB

  • memory/3000-47-0x0000000003B60000-0x0000000003B70000-memory.dmp

    Filesize

    64KB

  • memory/3000-48-0x0000000003B60000-0x0000000003B70000-memory.dmp

    Filesize

    64KB