Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    07/06/2024, 19:27

General

  • Target

    [Original] Magical Sounds 1.mp3

  • Size

    2.3MB

  • MD5

    ccce10714c5240329f00c16f59cd81e0

  • SHA1

    accf7d641f365902f0315a2106be233c15a522f6

  • SHA256

    f0c32919b62f1fe1c48c0786732f94181758fb2dbf7286b2d3edcbb57b5ca017

  • SHA512

    af6bcd1858474db25e2e18f233ac8fbeac3b1577c2f701af07458355c967712b26c9cee559e62b7e185904f87d1464ef831175984bef36beb682563779bc35af

  • SSDEEP

    49152:dAr/VG+3v/3zCCMc0+rf35faa/5hbAfWO4SbPXrFT7FxNUKipj:dY9R3v/3zC9Cfv/5RNVSbrRBnG

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[Original] Magical Sounds 1.mp3"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\[Original] Magical Sounds 1.mp3"
      2⤵
        PID:2696
      • C:\Windows\SysWOW64\unregmp2.exe
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
          3⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:4348
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb249cab58,0x7ffb249cab68,0x7ffb249cab78
        2⤵
          PID:5104
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:2
          2⤵
            PID:2744
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
            2⤵
              PID:3264
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2292 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
              2⤵
                PID:3704
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3116 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:1
                2⤵
                  PID:3172
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:1
                  2⤵
                    PID:644
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4332 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:1
                    2⤵
                      PID:4980
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4292 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
                      2⤵
                        PID:3444
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
                        2⤵
                          PID:904
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
                          2⤵
                            PID:4704
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
                            2⤵
                              PID:5072
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=2020,i,667071629827542850,13538019891765322777,131072 /prefetch:8
                              2⤵
                                PID:4184
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                                PID:1624
                              • C:\Windows\system32\taskmgr.exe
                                "C:\Windows\system32\taskmgr.exe" /4
                                1⤵
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:4868

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                7c4a4853a5e28e442fb0bfdd38ad75bb

                                SHA1

                                ea94bb7129c979c57640b9e65d09413533e855ab

                                SHA256

                                2c48786b15ff46b5572e25e6a36499921bb2ff88d3f0c9c9da20655696d78514

                                SHA512

                                cd296dc26379ba338d7f25bd09029d0118ec53fbc26bf6b3f156f883ea3899f834924bf5f29f43e05a1f43adba54f707ac02f87ad13fbeabcf151f1a8de38711

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                356B

                                MD5

                                5a75f9440ece5553418c26edc69ba5a6

                                SHA1

                                d0c34ad96f353acf7e59112ee72488512cdf3231

                                SHA256

                                4474f383ab587c6aef8fb81969c8635e92106107b35ca8610ebdf98b5d73c87a

                                SHA512

                                a64841f58ffce1c7efeaa68561424f6dd8ba4e1f2a3460590f82692b28c348fdfb9bb683cd295a69d107e02183e35358f8cbdc3faa4ec5cba3b13ea84a012556

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                7KB

                                MD5

                                34e9ff443222c0ce7da16f000fa68c09

                                SHA1

                                f160f47dccf9e8b0a24dd238e59421bdb5325d64

                                SHA256

                                af19f975425655ee6e2d2df26a6c2adec3e5b2cfc1560da3e8d548063a930dd9

                                SHA512

                                f51c41eb923ec423fd2eda01ae6d6ea316925cd77e12a4e479fa444148d348e5061b5f0a4601530d794820ff2825c4f888478b07f3e921f8c4f7c1a67c43a5cb

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                Filesize

                                16KB

                                MD5

                                0a7028735e507a21ac142f5d0abc0e64

                                SHA1

                                77258de34acc8daa3b5a79d399e8f290e300d688

                                SHA256

                                9ecd18f82d2dbd839576134abff4a888a92036c8606f5419eedd0f65604d92a4

                                SHA512

                                40e05374133ba5885c8846ae1bcb770a186898f1232a6fc275f99e90aea2b9326910d194795a0e6c32d721fb7fa78b4b5d45c96b0a7b79c954ec8408ff342fb7

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                263KB

                                MD5

                                c961fb11ab0631aa5c539559512de38a

                                SHA1

                                9f8e4a262bbcbd93452715677e621862a1bb6637

                                SHA256

                                fc76ba2cbb1611ce549e4a024402cc643e6f5a6842f4a4aa034f9eda5e6ef35b

                                SHA512

                                3f741a40776d4d8db1ea87ffa9a2cc136b8d0c3950202382253ab2e4b15587cb1949ab68210eff3f460c3cd6a329ddcccbc2e82a33acd99f396d66818129728c

                              • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                Filesize

                                256KB

                                MD5

                                3c0ba57539d7233aab31a10b4e91a289

                                SHA1

                                43904fa5431352106f370d841dbf8c482f338b1a

                                SHA256

                                2f366eb1850fc4950b5c7bc9ffb3d8c9892cce5bfaed6cd3a1aeef0d280f29b9

                                SHA512

                                bf21ba1905a072067265b88e14a3839b60332f61c2bacd39ee47d698e5bbe3f5c0f64f71017e0dc60322ef27aa30f212800b5e8e2b9906eeaf5fc4fdb01c8961

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

                                Filesize

                                9KB

                                MD5

                                7050d5ae8acfbe560fa11073fef8185d

                                SHA1

                                5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                SHA256

                                cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                SHA512

                                a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                              • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

                                Filesize

                                1KB

                                MD5

                                ea15163587d7d04e17a2fc01a2b68847

                                SHA1

                                42c3627cd66a52e2d6356cb243da2c135e2758fe

                                SHA256

                                ea8e6265a41fe96693bba6a0f1cfc8b2becc9c87dbbb7e6b11b9b0f138b594db

                                SHA512

                                4e972a7c7916eb3b450af3045a16f760fddb3430eaaa425338b311b0d53ef413aca4caeeaecec42c5151bf723172ad82a4792bfe778e7fb5d1b238951efde525

                              • memory/4868-164-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-165-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-163-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-175-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-174-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-173-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-172-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-171-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-170-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB

                              • memory/4868-169-0x00000169D1070000-0x00000169D1071000-memory.dmp

                                Filesize

                                4KB