Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
03/03/2023, 06:07
230303-gvgy7afh5x 903/03/2023, 06:03
230303-gsfcksgd64 103/03/2023, 05:58
230303-gpdpksfh4v 703/03/2023, 05:55
230303-gmxpnsgd56 7Analysis
-
max time kernel
128s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
03/03/2023, 05:58
General
-
Target
RadioBOSS_6.2.4.2/radioboss_setup_6.2.4.2_x64.exe
-
Size
35.8MB
-
MD5
f1a71910d9f05e56f21e5c4e5321ea02
-
SHA1
be4ac8e874614e4ffd4aafc7f2e9b35b6f1bfb28
-
SHA256
f66722f101920c6de52bc9b20cd5f3fe14db00e4e8007edf418678bf8197afda
-
SHA512
bd5aee9ddb2eed2d85ef8ef22f169f58c7f445766eeb60996bb9e9fe882ecd4eb83052ce597501ebbf6a14e40775c109aeb3ccda5296207a983b66228a5c8224
-
SSDEEP
786432:lOHIhav4EctmtB39Owwwqnn8sN7N3uXGmg8tra:lOHIhav4p8HNOp88ZeXG6tra
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RadioBOSS_6.2.4.2\radioboss_setup_6.2.4.2_x64.exe"C:\Users\Admin\AppData\Local\Temp\RadioBOSS_6.2.4.2\radioboss_setup_6.2.4.2_x64.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BS405.tmp\radioboss_setup_6.2.4.2_x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-BS405.tmp\radioboss_setup_6.2.4.2_x64.tmp" /SL5="$D0054,36566931,1069568,C:\Users\Admin\AppData\Local\Temp\RadioBOSS_6.2.4.2\radioboss_setup_6.2.4.2_x64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD5b236ad1728627e91cff6a81030aa2549
SHA12598b4c6eb86cdbcf2b6f93211c49caf68db1a9d
SHA256e8094b0e81b3c167b2b5078def8599c915286838244f04af27f03ce09d6c08b6
SHA5121fccde9dc4ea8ead138db581272e373d3687f5cfb0e6836ee39f7f851153ef9092ae2346cf2a676c0bac4816ca916f16ce51e30a6c6e17af970182ed3b635471
-
Filesize
40B
MD520ffe6db2ae36f6b2cb0572abd04584b
SHA1a8f7599314d1fa0b587760ec128e4ba63455849d
SHA2565814fb99d2616ba5beb5de695617ea4100f7b6208515b55995544ed19d6e985e
SHA51287ebd2ce53a0ba7cd2fa57659e6d57a7d190ff28299cc8001e6d8ee5ef5c5075121cecb1df957549ba5ea16c0d1305e9e9efaa0df4030e94e0538f233f1d4e4b
-
Filesize
592KB
MD5807c54ce9e32a0f6065b4d806864a5e0
SHA15da66595a352dd94a1bb54ac8f19dd38e7a0c3d3
SHA256c04879c8d8f88142da5176d0792efcb1d9f453017f905fcb6b35588a01f1a9f4
SHA512e70ac993ac6258b02e9b8e4e51dd3a11c15e55152902e195ac9c883761aacfeb9b6490fd8dc9bd70484081b72c7ea9abf36ffa734c6aa63b941e4c9930fb70b3
-
Filesize
1.5MB
MD5f2feac1449145c88f6639b50795c7aae
SHA1e003f3b759d7907931703670fc69db766c72d775
SHA256330480ac09844dc6a4f2c87d2fad0a7972617599bb057e7979dd6d7f22710ef1
SHA512404fd22daf71b797603fb8ad0a85fff42831df5548bbd37682702703b833645d3132669c0fc2b6c7cfdd7bdeadd4d49360e7efa522bb4eb537a31b8cfb410412
-
Filesize
3.3MB
MD5830e93873039294d7480b2901cb7ae55
SHA1732b6d59af42388fd456da9a81aa83b6cd17053e
SHA256ff268aecd5b7d29f3f87067ba65edc8a9ac98fc0580c2a071ddcf8d5c5d90621
SHA512695869a980ede17ad045cb60ab70109d779be7fbfe6299017ed67199c894a937ef7bc3a35aab3e0afefc38885887f2630470c1ac37be0d2898f96efd1c58affe
-
Filesize
3.3MB
MD5830e93873039294d7480b2901cb7ae55
SHA1732b6d59af42388fd456da9a81aa83b6cd17053e
SHA256ff268aecd5b7d29f3f87067ba65edc8a9ac98fc0580c2a071ddcf8d5c5d90621
SHA512695869a980ede17ad045cb60ab70109d779be7fbfe6299017ed67199c894a937ef7bc3a35aab3e0afefc38885887f2630470c1ac37be0d2898f96efd1c58affe
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4KB