Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    29s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2025, 10:45 UTC

General

  • Target

    bewm.mov

  • Size

    766KB

  • MD5

    2fe7334666b7da49de744e0f83f6b237

  • SHA1

    e0376277c4e788a6e51e20f78e27275a37af2b2b

  • SHA256

    b98f6794703b2327b9b72011950d8831b0323fc959c5ee5b8a31b90eea007334

  • SHA512

    deb8d4a66a82cf5bf9827ba76911d7cbbc0d5f44905ed137a2b558c30c2279a6a83f50f05b3e4fca957e557a5a02482fb9dd905ec10a06cbcc90af7c831c80e3

  • SSDEEP

    12288:HoQyN1mkXViCdZIKB1NSskgKycJse+UYnpcJHUzRc0DVrHL8i0zvtKX79/J8EB:HoQyrmkF7ZloXwcJszUYKUVBrHprkEB

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\bewm.mov"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:2176
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:716
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2cc 0x3f4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3220

Network

  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    130.238.56.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    130.238.56.23.in-addr.arpa
    IN PTR
    Response
    130.238.56.23.in-addr.arpa
    IN PTR
    a23-56-238-130deploystaticakamaitechnologiescom
  • flag-us
    DNS
    5.114.82.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    5.114.82.104.in-addr.arpa
    IN PTR
    Response
    5.114.82.104.in-addr.arpa
    IN PTR
    a104-82-114-5deploystaticakamaitechnologiescom
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    130.238.56.23.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    130.238.56.23.in-addr.arpa

  • 8.8.8.8:53
    5.114.82.104.in-addr.arpa
    dns
    71 B
    135 B
    1
    1

    DNS Request

    5.114.82.104.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    64KB

    MD5

    987a07b978cfe12e4ce45e513ef86619

    SHA1

    22eec9a9b2e83ad33bedc59e3205f86590b7d40c

    SHA256

    f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

    SHA512

    39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    1024KB

    MD5

    df0eb6f7353e394a19c523015275ccfb

    SHA1

    6f127d3e9c0e4e0fe6ed265945b330ead3f5245e

    SHA256

    d638d3393fa96d814fffcf63be9cb134d18925a9d729aca027ee01d59402c697

    SHA512

    9f074f6234749b7e568fbaa759549ba8a00fd82eb819d0053cd41d058a7e1c0bcb737aa96ecc6a84b93cb0dbc37ff52cf1139d4a0fb02818ec40401d366f600e

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

    Filesize

    68KB

    MD5

    54b2ab84d0378bf806e7126740d1a807

    SHA1

    07c5cdb4a70f71a78a7a29692b9942508daae891

    SHA256

    cc3612a36ec7d4868271cc2a24604c42dd26164fbade46084a91018a3da63870

    SHA512

    fdcda1ed83f2d8025c6a0874536d396e9a7b0a403c2bb792bfa9a94c0886e12cc763304322a22f3326b46fbcd19542e10351d37d0d5d09ef79396ffc64e94714

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

    Filesize

    498B

    MD5

    90be2701c8112bebc6bd58a7de19846e

    SHA1

    a95be407036982392e2e684fb9ff6602ecad6f1e

    SHA256

    644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

    SHA512

    d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    1KB

    MD5

    ae2c2e85291b8ac4b0e0ab57ce730c57

    SHA1

    73ac1295e79cdcec49f08655bd1d8cd853f8fa22

    SHA256

    7b82248eb77fafd140725439cb75ead91e0ff78d32e3af24a2aa687ddc19a01c

    SHA512

    2b3dc3ae608944684120cff26d43279a60677317a651488cce724eda6d7bd7f33d2413d312509755819c738f320e1de2835e732fcb340591ff3fcbdc610fcd04

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

    Filesize

    1KB

    MD5

    a85c9e78c3529b8e85fa386957a12bb2

    SHA1

    525bf911e6c28710852ab1cfba96295a8d9643fd

    SHA256

    8f528e0c2826ea294ed13d3130702b78d3e1c05cc1a607a51140d081f5688498

    SHA512

    439e1969cf91a385ad95da37b6370bd2be5c731461920703872269ca83ff4d2a84b11639a23f06176c9309f4a1c122908ac2b75ff70122cf12e94b4eaf876d23

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

    Filesize

    3KB

    MD5

    afefa9fb5acef459df231e0cdc2e8407

    SHA1

    390a489f2ae9b1785c98812966959a76af17afb3

    SHA256

    79bce0f029f9910b0be62387691287f071569e4f3bff1875788be05f95dcca30

    SHA512

    6927b724d7cfe31c5653db3067b2e1262de881429ff790fd7f84175da3177497c76111dcd19745725876c2dac53b54a040edf26b9b80ecb080241cf51ba3c9d2

  • memory/1900-76-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-80-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-35-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-37-0x0000000006E40000-0x0000000006E50000-memory.dmp

    Filesize

    64KB

  • memory/1900-38-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-39-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-41-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-40-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-42-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-57-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

    Filesize

    64KB

  • memory/1900-58-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-59-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-60-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-61-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-62-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-63-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-64-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-65-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-67-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-68-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-66-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-69-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-71-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-72-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-74-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-73-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-70-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-75-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-34-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-77-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-33-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-78-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-89-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-82-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

    Filesize

    64KB

  • memory/1900-79-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-83-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-84-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-85-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-86-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-88-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-81-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-91-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-93-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-92-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-90-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-87-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-94-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-95-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-96-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-99-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-98-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-97-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-100-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-101-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-102-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-103-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-104-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-106-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-107-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

    Filesize

    64KB

  • memory/1900-105-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-108-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-110-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-36-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-109-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.