Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6Beholder_ ...re.zip
windows7-x64
1Beholder_ ...re.zip
windows10-2004-x64
1Android/ob...ee.zip
windows7-x64
1Android/ob...ee.zip
windows10-2004-x64
1assets/Logo/logo1.mp4
windows7-x64
1assets/Logo/logo1.mp4
windows10-2004-x64
6assets/Logo/logo2.mp4
windows7-x64
1assets/Logo/logo2.mp4
windows10-2004-x64
6assets/Uni...n.json
windows7-x64
3assets/Uni...n.json
windows10-2004-x64
3assets/bin...000000
windows7-x64
1assets/bin...000000
windows10-2004-x64
1assets/bin...6cd535
windows7-x64
1assets/bin...6cd535
windows10-2004-x64
1assets/bin...23b72b
windows7-x64
1assets/bin...23b72b
windows10-2004-x64
1assets/bin...247a10
windows7-x64
1assets/bin...247a10
windows10-2004-x64
1assets/bin...45cca7
windows7-x64
1assets/bin...45cca7
windows10-2004-x64
1assets/bin...65105d
windows7-x64
1assets/bin...65105d
windows10-2004-x64
1assets/bin...6d79f6
windows7-x64
1assets/bin...6d79f6
windows10-2004-x64
1assets/bin...9897ac
windows7-x64
1assets/bin...9897ac
windows10-2004-x64
1assets/bin...7bf85e
windows7-x64
1assets/bin...7bf85e
windows10-2004-x64
1assets/bin...29fc78
windows7-x64
1assets/bin...29fc78
windows10-2004-x64
1assets/bin...04a31f
windows7-x64
1assets/bin...04a31f
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 02:16
Static task
static1
Behavioral task
behavioral1
Sample
Beholder_ Adventure_2.6.260_APKPure.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Beholder_ Adventure_2.6.260_APKPure.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Android/obb/com.creativemobile.beholderfree/main.260.com.creativemobile.beholderfree.zip
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Android/obb/com.creativemobile.beholderfree/main.260.com.creativemobile.beholderfree.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
assets/Logo/logo1.mp4
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
assets/Logo/logo1.mp4
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
assets/Logo/logo2.mp4
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
assets/Logo/logo2.mp4
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
assets/UnityServicesProjectConfiguration.json
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
assets/UnityServicesProjectConfiguration.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
assets/bin/Data/0000000000000000f000000000000000
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
assets/bin/Data/0000000000000000f000000000000000
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
assets/bin/Data/000f5b1515d06f1449968c77136cd535
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
assets/bin/Data/000f5b1515d06f1449968c77136cd535
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
assets/bin/Data/001a40d38db2e2e45af7fe681123b72b
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
assets/bin/Data/001a40d38db2e2e45af7fe681123b72b
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
assets/bin/Data/002130a1018259c40b40ef305d247a10
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
assets/bin/Data/002130a1018259c40b40ef305d247a10
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
assets/bin/Data/003041528ced7e9489f9c9d8dc45cca7
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
assets/bin/Data/003041528ced7e9489f9c9d8dc45cca7
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
assets/bin/Data/005e69c442679cd43814f2cd5c65105d
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
assets/bin/Data/005e69c442679cd43814f2cd5c65105d
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
assets/bin/Data/00691a9df77177b43a7767a4826d79f6
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
assets/bin/Data/00691a9df77177b43a7767a4826d79f6
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
assets/bin/Data/0078594822131ad49b77961bac9897ac
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
assets/bin/Data/0078594822131ad49b77961bac9897ac
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
assets/bin/Data/0080368375c37164e9e7f29b7b7bf85e
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
assets/bin/Data/0080368375c37164e9e7f29b7b7bf85e
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
assets/bin/Data/00c6d7022de18f046a9dfc212129fc78
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
assets/bin/Data/00c6d7022de18f046a9dfc212129fc78
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
assets/bin/Data/00f43663d5dcfd7438bc2ec14904a31f
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
assets/bin/Data/00f43663d5dcfd7438bc2ec14904a31f
Resource
win10v2004-20240802-en
General
-
Target
assets/Logo/logo2.mp4
-
Size
1.5MB
-
MD5
e4313411208de6204df61a5e318255e9
-
SHA1
a6285e81e2daedd2dff19136a58c9e4dfdf2f128
-
SHA256
0636cff51545ad4a4a65d763d75b5f243e2fa228ccfbc205b1423df10c453665
-
SHA512
9a0fc0aa94428ec3540cf7fbfcbeb3f799dfffb6a0dced68b9f876a9b42863074bd3c82c4d7b016bddd0488b36f37650c04215183412e1c7f8a8b0842e143a98
-
SSDEEP
24576:cfOp3QWeWXns6RpzVwwJ7wNxPL+OX/wH8PQtlIfaSjJ:cmpAins6Rxq+wrPfhEIj
Malware Config
Signatures
-
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{66036223-C262-4374-8D1F-74565729CAAE} wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 1028 unregmp2.exe Token: SeCreatePagefilePrivilege 1028 unregmp2.exe Token: SeShutdownPrivilege 5032 wmplayer.exe Token: SeCreatePagefilePrivilege 5032 wmplayer.exe Token: 33 1984 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1984 AUDIODG.EXE Token: SeShutdownPrivilege 5032 wmplayer.exe Token: SeCreatePagefilePrivilege 5032 wmplayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5032 wmplayer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4620 5032 wmplayer.exe 88 PID 5032 wrote to memory of 4620 5032 wmplayer.exe 88 PID 5032 wrote to memory of 4620 5032 wmplayer.exe 88 PID 4620 wrote to memory of 1028 4620 unregmp2.exe 89 PID 4620 wrote to memory of 1028 4620 unregmp2.exe 89
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\assets\Logo\logo2.mp4"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:4332
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4c4 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD51baea65aba049862a6d7a18c00aa3302
SHA174ead72ed2952ed9ad645b2703d06673a566d75f
SHA256a76033d434f2b88331aed83039bdfb958d0332d2afb97731d3b644c6b48d47d9
SHA512a030ad3f821f6ed0e3371b55b00b33e14ae298a791b509d67ee0df40cf67020e2a8112f1474dd24d55e2aab0f16bc20450158da9b37cb439f87abfafe9f50d69
-
Filesize
1024KB
MD54e337519001b4be6989de464f1c6518f
SHA1e9372e76332be83c7a76a86212714f1818051edc
SHA2564318fba134261d4592b4b4eea1b9e8ab6d001cc957a7f849795a2a089e9e1e34
SHA51264d865d37c672750c8c71fccfb4d5466ad5cddee806868083bed0033144c6b58642d7301a8dc3ddee342670b2c48ed424490d39f6f26cb72f7eeb485c4652989
-
Filesize
68KB
MD5d233ddee0a3e1785dbb9a01530bd7988
SHA1ecd739b306e8e445fc62e0ebbfec1b9e15f2a574
SHA2562f6625a8ff45683d0b16432bd6bea8b2baf1b982c3a834d457a28d3a7563ce94
SHA5125c9862c4d280e59d6fdcf7c13624024fa2f34f63262b752a38b9015299429893737d15c850993285952c5c42ab689f91c55bd95aa9953376a6220ded9a2c0ed9
-
Filesize
498B
MD590be2701c8112bebc6bd58a7de19846e
SHA1a95be407036982392e2e684fb9ff6602ecad6f1e
SHA256644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
SHA512d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
-
Filesize
9KB
MD55433eab10c6b5c6d55b7cbd302426a39
SHA1c5b1604b3350dab290d081eecd5389a895c58de5
SHA25623dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
SHA512207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
-
Filesize
1KB
MD5fd50d66b22f02f8fdd12295bbc76e1bf
SHA1a21d39521eb572b230785c253d42fca8d02cd02c
SHA25686f9b4a27283927da1aeea9eddc89fbfcc9f32b03ed9e672d77aa9256e65a22b
SHA512b1904cf291f567f9c8e69b8a9df1efc10f2283d638e3c5c7920a63c082d8e18ce1f48cae8a5fbcb3981ef0c1a16e7a5db09fd74a6ff972d511cf50e82f3ef2b0