Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    33s
  • max time network
    34s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/05/2024, 17:05

General

  • Target

    Mechatronics Trade 2- WorldSkills Competition 2022 Special Edition in Stuttgart.mp4

  • Size

    37.9MB

  • MD5

    6a4e59bf3be0b7a543be751314f4e249

  • SHA1

    d47542e82faf118563389dbccfb8694c7813db0b

  • SHA256

    d19c6581198a3b57177ead7b9f324ea7fc03334e9ddca161c319bd47d4d1b77c

  • SHA512

    23988c5113ab4cd8b4d249d4bce129f5505c2311cf2cfb3cf3056c2bc1419f2f20d2a41e308a951f6ccb33528367c1541260e13068a8bdd3529e811e49a4ec1e

  • SSDEEP

    786432:5BYaYdZtk3eqTFtfYE4tAGyd7B2Kk8tZQJpZf61QgRUAqmiE0:5BYXdUuHtAGyd7B2VISJptgRCmiL

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Mechatronics Trade 2- WorldSkills Competition 2022 Special Edition in Stuttgart.mp4"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Mechatronics Trade 2- WorldSkills Competition 2022 Special Edition in Stuttgart.mp4"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\unregmp2.exe
        C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
          4⤵
          • Modifies Installed Components in the registry
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          • Modifies registry class
          PID:1492
      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Mechatronics Trade 2- WorldSkills Competition 2022 Special Edition in Stuttgart.mp4"
        3⤵
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2172
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:340
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:4008
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:4380
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004C8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    256KB

    MD5

    1a0295014678e91e7fea0a79074d6ffc

    SHA1

    f93a33dfd19a09d92174a17f0912440ddb1479a0

    SHA256

    fba2e401545352472136e5c71b0596b9125ddcfe2b87c439d8567cb2dad16745

    SHA512

    d7aec99cf127bf009bad534f293b65ce93ed08c650312a32ea670b0cf09dcaa0906962d9b29ce6c078396885e8ce55bf5ae5598c2480fd508ebddd111bd6c882

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    1024KB

    MD5

    55311cdce4307073a80e03c32eaa6cb1

    SHA1

    2907b26dfb116b6c4ddc9a2acc7994bfe2e90ebf

    SHA256

    c572ad140111889e4bdc76c76a80395e072b8e85d78cd7479792164d378aa6c8

    SHA512

    1871e5ca384acc7ebffdabf624432d851b081d9c45d9188b44e3c5821116b0b33337b071f3a40eb373b7aaa01831a12657352ba213e52b1d7009034158b5b500

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    1KB

    MD5

    e7158d215ff2719e668c6c5c96059cfb

    SHA1

    53354eabff4de1576be4a1e82befccd767cfae54

    SHA256

    1349a0a9016b02f183c934a9992bc98e30dd2006e2752f3fcf7ccb33f52d7d28

    SHA512

    dc68db44d6f84d2d3e61928f418e2d6069fd11b41584e4f6b87a86987b460a109f859261e960bde12467e30f8f2727f6e35395623741168a000799136eb77241

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    2KB

    MD5

    feb1db60429eab14e414d192be5ea0f0

    SHA1

    6fe397455b452355514494a58b3adb26b1aab311

    SHA256

    843c6a50ca27f64ab229c316fa4f6796697e75f6663c99f9ba7193e8882cc9d8

    SHA512

    c23749ee5bea53bfb971463342e20e8e461f9f108f9ae407a379e84389072bb077a97aca54239f4869ec3b2acc9481ef6622e09726db9f277589d8a770c9faf9

  • memory/2172-47-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB

  • memory/2172-45-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB

  • memory/2172-48-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB

  • memory/2172-49-0x00000000082F0000-0x0000000008300000-memory.dmp

    Filesize

    64KB

  • memory/2172-51-0x00000000060F0000-0x0000000006100000-memory.dmp

    Filesize

    64KB

  • memory/2172-53-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB

  • memory/2172-52-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB

  • memory/2172-50-0x00000000060F0000-0x0000000006100000-memory.dmp

    Filesize

    64KB

  • memory/2172-54-0x00000000060F0000-0x0000000006100000-memory.dmp

    Filesize

    64KB

  • memory/2172-46-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB