Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    29s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2025, 10:45

General

  • Target

    bewm.mov

  • Size

    766KB

  • MD5

    2fe7334666b7da49de744e0f83f6b237

  • SHA1

    e0376277c4e788a6e51e20f78e27275a37af2b2b

  • SHA256

    b98f6794703b2327b9b72011950d8831b0323fc959c5ee5b8a31b90eea007334

  • SHA512

    deb8d4a66a82cf5bf9827ba76911d7cbbc0d5f44905ed137a2b558c30c2279a6a83f50f05b3e4fca957e557a5a02482fb9dd905ec10a06cbcc90af7c831c80e3

  • SSDEEP

    12288:HoQyN1mkXViCdZIKB1NSskgKycJse+UYnpcJHUzRc0DVrHL8i0zvtKX79/J8EB:HoQyrmkF7ZloXwcJszUYKUVBrHprkEB

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\bewm.mov"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Windows\system32\unregmp2.exe
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        3⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        PID:2176
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:716
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2cc 0x3f4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    64KB

    MD5

    987a07b978cfe12e4ce45e513ef86619

    SHA1

    22eec9a9b2e83ad33bedc59e3205f86590b7d40c

    SHA256

    f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

    SHA512

    39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

    Filesize

    1024KB

    MD5

    df0eb6f7353e394a19c523015275ccfb

    SHA1

    6f127d3e9c0e4e0fe6ed265945b330ead3f5245e

    SHA256

    d638d3393fa96d814fffcf63be9cb134d18925a9d729aca027ee01d59402c697

    SHA512

    9f074f6234749b7e568fbaa759549ba8a00fd82eb819d0053cd41d058a7e1c0bcb737aa96ecc6a84b93cb0dbc37ff52cf1139d4a0fb02818ec40401d366f600e

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

    Filesize

    68KB

    MD5

    54b2ab84d0378bf806e7126740d1a807

    SHA1

    07c5cdb4a70f71a78a7a29692b9942508daae891

    SHA256

    cc3612a36ec7d4868271cc2a24604c42dd26164fbade46084a91018a3da63870

    SHA512

    fdcda1ed83f2d8025c6a0874536d396e9a7b0a403c2bb792bfa9a94c0886e12cc763304322a22f3326b46fbcd19542e10351d37d0d5d09ef79396ffc64e94714

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

    Filesize

    498B

    MD5

    90be2701c8112bebc6bd58a7de19846e

    SHA1

    a95be407036982392e2e684fb9ff6602ecad6f1e

    SHA256

    644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

    SHA512

    d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • C:\Users\Admin\AppData\Local\Temp\wmsetup.log

    Filesize

    1KB

    MD5

    ae2c2e85291b8ac4b0e0ab57ce730c57

    SHA1

    73ac1295e79cdcec49f08655bd1d8cd853f8fa22

    SHA256

    7b82248eb77fafd140725439cb75ead91e0ff78d32e3af24a2aa687ddc19a01c

    SHA512

    2b3dc3ae608944684120cff26d43279a60677317a651488cce724eda6d7bd7f33d2413d312509755819c738f320e1de2835e732fcb340591ff3fcbdc610fcd04

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

    Filesize

    1KB

    MD5

    a85c9e78c3529b8e85fa386957a12bb2

    SHA1

    525bf911e6c28710852ab1cfba96295a8d9643fd

    SHA256

    8f528e0c2826ea294ed13d3130702b78d3e1c05cc1a607a51140d081f5688498

    SHA512

    439e1969cf91a385ad95da37b6370bd2be5c731461920703872269ca83ff4d2a84b11639a23f06176c9309f4a1c122908ac2b75ff70122cf12e94b4eaf876d23

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

    Filesize

    3KB

    MD5

    afefa9fb5acef459df231e0cdc2e8407

    SHA1

    390a489f2ae9b1785c98812966959a76af17afb3

    SHA256

    79bce0f029f9910b0be62387691287f071569e4f3bff1875788be05f95dcca30

    SHA512

    6927b724d7cfe31c5653db3067b2e1262de881429ff790fd7f84175da3177497c76111dcd19745725876c2dac53b54a040edf26b9b80ecb080241cf51ba3c9d2

  • memory/1900-76-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-80-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-35-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-37-0x0000000006E40000-0x0000000006E50000-memory.dmp

    Filesize

    64KB

  • memory/1900-38-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-39-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-41-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-40-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-42-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-57-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

    Filesize

    64KB

  • memory/1900-58-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-59-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-60-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-61-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-62-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-63-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-64-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-65-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-67-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-68-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-66-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-69-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-71-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-72-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-74-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-73-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-70-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-75-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-34-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-77-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-33-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-78-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-89-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-82-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

    Filesize

    64KB

  • memory/1900-79-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-83-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-84-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-85-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-86-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-88-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-81-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-91-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-93-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-92-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-90-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-87-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-94-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-95-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-96-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-99-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-98-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-97-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-100-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-101-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-102-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-103-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-104-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-106-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-107-0x000000000C2E0000-0x000000000C2F0000-memory.dmp

    Filesize

    64KB

  • memory/1900-105-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-108-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB

  • memory/1900-110-0x0000000006D10000-0x0000000006D20000-memory.dmp

    Filesize

    64KB

  • memory/1900-36-0x0000000004890000-0x00000000048A0000-memory.dmp

    Filesize

    64KB

  • memory/1900-109-0x000000000C300000-0x000000000C310000-memory.dmp

    Filesize

    64KB