Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/06/2024, 02:41

240624-c6rwbavglc 1

24/06/2024, 02:39

240624-c5bspsyepr 8

Analysis

  • max time kernel
    37s
  • max time network
    36s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24/06/2024, 02:39

General

  • Target

    audio-editor-output_3_1.mp3

  • Size

    910KB

  • MD5

    97ff109c1cd624d64bc8b475f3d20e3a

  • SHA1

    91f0e37d3d18d05857233a0b267b80391293fc1a

  • SHA256

    b00206564060bd40748ea7094b1b3f0ec3b2dfca6a0bd8ea46eb189c59429eb7

  • SHA512

    0bc46e398c14a838cf8d2e24d5dc3c47c9bc0db5587b6d0f6abe1b06bc8d2cfa5c454bef03ac1fabfcf58498bf9eccc655f849a390f129fdffc563405174edf5

  • SSDEEP

    12288:XK9DH8yWU3ACs77fgAwGcgXl7Qgb45gv+BUG9yWwOBXZC9pbYe97Hjr9zvwETRWF:2cyNQ9P2kbbGBUYzwnTZ71z9cQ0AZxW

Score
8/10

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops desktop.ini file(s) 8 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\audio-editor-output_3_1.mp3"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Program Files (x86)\Windows Media Player\setup_wm.exe
      "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\audio-editor-output_3_1.mp3"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\SysWOW64\unregmp2.exe
        C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          • Modifies registry class
          PID:1240
      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\audio-editor-output_3_1.mp3"
        3⤵
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:4824
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:32
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:1384
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:4604
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    64KB

    MD5

    066f6e5acfff197d12b550ef7d452d41

    SHA1

    aaa8cfa5a56519594490d069f31a42a15ca515a2

    SHA256

    cac3a8354c7766b4ce0900bf4d8097bf372ec405a6af4bba63a6d92132932a30

    SHA512

    21c3985bdc883b7c0fcdfb660a577eb03870943d9e812a24726158b6c06cc36b00425fdeafddcb099fddd1488173280563f7241c9589e69d04d1eb1b5daa786b

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    1024KB

    MD5

    f6522c9e0ddd787d6d7aa62e5a5ef707

    SHA1

    e3eb6138623ad1bca44824e8246eb02bc8fcc6e7

    SHA256

    0feafdd36a3927ec91f7e391d3f4743acd4c6d36d80a07ca2a13ad9d835a517b

    SHA512

    853dfb3dbb1489e89f4150fa9396190ce1049c4435bda05a81e666486f0eb8e8109a7939ce45fd233857b0050ad29ccd5d87489089bc6caefbc3f166bcba7509

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    1KB

    MD5

    d57f8e2feb06020afea74392163a124e

    SHA1

    a2d33716efad68e5cf2dbc0dcc20fec2e750bc6d

    SHA256

    5d6aba4007caed96be54efb9c426132bd3273606928a83a07dc547806b84273b

    SHA512

    d3fd7bb819b42fa9b25afd85a9a0900e3f027edaa42bfb1ca63296a65bb42da8e23d931185a72c162ce79d0211e279f0245a25d903bad93ace11bd31e623d59b

  • memory/4824-40-0x00000000042F0000-0x0000000004300000-memory.dmp

    Filesize

    64KB

  • memory/4824-41-0x00000000042F0000-0x0000000004300000-memory.dmp

    Filesize

    64KB

  • memory/4824-43-0x00000000042F0000-0x0000000004300000-memory.dmp

    Filesize

    64KB

  • memory/4824-42-0x00000000042F0000-0x0000000004300000-memory.dmp

    Filesize

    64KB

  • memory/4824-45-0x00000000042F0000-0x0000000004300000-memory.dmp

    Filesize

    64KB

  • memory/4824-44-0x00000000042F0000-0x0000000004300000-memory.dmp

    Filesize

    64KB

  • memory/4824-59-0x0000000006D70000-0x0000000006D80000-memory.dmp

    Filesize

    64KB

  • memory/4824-66-0x0000000006D70000-0x0000000006D80000-memory.dmp

    Filesize

    64KB