Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
12/06/2024, 20:12
General
-
Target
clip_12.mp4
-
Size
62.6MB
-
MD5
c790f7e78bc06de9b8c1e23e5be7c822
-
SHA1
a9d73b1901fe9a39b8945fa4299af11416f48eb6
-
SHA256
008edfc7f5ddee99f159ce144bfea2d812827e79aebe6b2a8e9c997876b280a5
-
SHA512
2ef762f374a9ea3f26872475b134dd7317f25c8d050798f856771562875352aa3849a1c4811703f32095ebb86da31a5cbb20b4a7b1f7ba18d17581f37804dce3
-
SSDEEP
1572864:sDy3/lM5Z4BynOjorIBWfO+1QI5PD8eDMIqvR2+kk2wzycGDoehfDIiIFw:sDpTMynOjorISO+P7VDMZ2C2wFGDuhw
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 43 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\clip_12.mp4"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\clip_12.mp4"2⤵
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\clip_12.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a8 0x4b81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5c374c25875887db7d072033f817b6ce1
SHA13a6d10268f30e42f973dadf044dba7497e05cdaf
SHA25605d47b87b577841cc40db176ea634ec49b0b97066e192e1d48d84bb977e696b6
SHA5126a14f81a300695c09cb335c13155144e562c86bb0ddfdcab641eb3a168877ad3fcc0579ad86162622998928378ea2ffe5a244b3ddbe6c11a959dbb34af374a7d
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD53df8e3b4e07b4eec39689bd8deb53241
SHA151f1672847cde079bf85f983b1e122968be2d6b0
SHA2560a3a2c64ed419c3a75df6c1f9582d7db3357a09211ece2b8e002dfbbbced580c
SHA512fc2ee24691737c66348b6889f161990afbbea5f15911fdb738195bbbe1d3f591aacb4218808ac8802ba3c01efedf97597b5660ee169500ae0740498da11e59c2
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
96KB
-
Filesize
992KB
-
Filesize
68KB
-
Filesize
1.5MB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
260KB
-
Filesize
16.7MB
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
16.7MB