Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
24/11/2023, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe
Resource
win10-20231020-en
General
-
Target
68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe
-
Size
1.9MB
-
MD5
39e20b6c192664e74aa283bad52cb1e8
-
SHA1
a894d560dee4033ce6fb4f829374163c605fd588
-
SHA256
68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1
-
SHA512
80d08668fbd8678e01bc5a95f237563e3658ccffc764f72217127651c9eea4a49084b0b10f5a99fd49e2f62a6f85671b6f092f77d6d5674b4c52f3cccaa48a4e
-
SSDEEP
24576:syPyYoH+Bd5tKoWQiUZeMGU/6oOCcjMirjkcCUKK7AiRY/jJx5b6lyAmY:ba/eBd5tZiUGO6nCcj3QcTpKrJr6S
Malware Config
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1dV92Na5.exe -
Executes dropped EXE 4 IoCs
pid Process 1720 ym8Ev33.exe 4560 NF8Vm52.exe 992 tf7UR54.exe 4508 1dV92Na5.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ym8Ev33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" NF8Vm52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" tf7UR54.exe Set value (str) \REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1dV92Na5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3244 schtasks.exe 2724 schtasks.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3772 wrote to memory of 1720 3772 68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe 71 PID 3772 wrote to memory of 1720 3772 68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe 71 PID 3772 wrote to memory of 1720 3772 68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe 71 PID 1720 wrote to memory of 4560 1720 ym8Ev33.exe 72 PID 1720 wrote to memory of 4560 1720 ym8Ev33.exe 72 PID 1720 wrote to memory of 4560 1720 ym8Ev33.exe 72 PID 4560 wrote to memory of 992 4560 NF8Vm52.exe 73 PID 4560 wrote to memory of 992 4560 NF8Vm52.exe 73 PID 4560 wrote to memory of 992 4560 NF8Vm52.exe 73 PID 992 wrote to memory of 4508 992 tf7UR54.exe 74 PID 992 wrote to memory of 4508 992 tf7UR54.exe 74 PID 992 wrote to memory of 4508 992 tf7UR54.exe 74 PID 4508 wrote to memory of 3244 4508 1dV92Na5.exe 75 PID 4508 wrote to memory of 3244 4508 1dV92Na5.exe 75 PID 4508 wrote to memory of 3244 4508 1dV92Na5.exe 75 PID 4508 wrote to memory of 2724 4508 1dV92Na5.exe 77 PID 4508 wrote to memory of 2724 4508 1dV92Na5.exe 77 PID 4508 wrote to memory of 2724 4508 1dV92Na5.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe"C:\Users\Admin\AppData\Local\Temp\68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ym8Ev33.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ym8Ev33.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8Vm52.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8Vm52.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tf7UR54.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tf7UR54.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dV92Na5.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dV92Na5.exe5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:3244
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:2724
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD51c51deb1bba6e464f0577bc37406b334
SHA1c19c0bb0df2c8b88bf054f0bddd470f61c1d74aa
SHA256d1c3b3b7642aec487f30237e2d31aeaa28bffcc4d839ea11a7a48d1e8e94153d
SHA512431c6fd57d7dd4c3593b496bc2ed3c1abd7aadedc1d9f85ff996cc17ee89dd3e90db34b431c47a7a729e86f7e8fef72a869dcc34b36761f012e8e3c7f5a01302
-
Filesize
1.6MB
MD589fdd7d307b84e4438f122f82d12cdcb
SHA19125437f6b7b1095effbfe9a9169eb7f43b44a33
SHA256ae5fef89e4ac27b9eeacfb2bb259de20d6e2aa7dad494d5237322377b943be79
SHA5120633fc267d092c6e0595577c370756df90f424dbce6e7b9cb82a6d31d05661a5c1693de77bf05a877af6a8bc4ef26e6a7859a3953986a45d0030c9adf382456f
-
Filesize
1.6MB
MD589fdd7d307b84e4438f122f82d12cdcb
SHA19125437f6b7b1095effbfe9a9169eb7f43b44a33
SHA256ae5fef89e4ac27b9eeacfb2bb259de20d6e2aa7dad494d5237322377b943be79
SHA5120633fc267d092c6e0595577c370756df90f424dbce6e7b9cb82a6d31d05661a5c1693de77bf05a877af6a8bc4ef26e6a7859a3953986a45d0030c9adf382456f
-
Filesize
1.1MB
MD5f4959dc5fdf2db19ec08a33c72da77fd
SHA1b3b24927546b51db20c3ce6106dd0b591e105c4f
SHA2562024a04c8039caaf332c25f731a4d8808878974a2b213d2ddcc19559af9cd714
SHA51238d4f618078584ef203da1098957d103120f1b9e781a8f9c1141d160bf2fc219c11c8d0453789c6ad39384c617005263cbb10bd636eeee065d5d22b93081535a
-
Filesize
1.1MB
MD5f4959dc5fdf2db19ec08a33c72da77fd
SHA1b3b24927546b51db20c3ce6106dd0b591e105c4f
SHA2562024a04c8039caaf332c25f731a4d8808878974a2b213d2ddcc19559af9cd714
SHA51238d4f618078584ef203da1098957d103120f1b9e781a8f9c1141d160bf2fc219c11c8d0453789c6ad39384c617005263cbb10bd636eeee065d5d22b93081535a
-
Filesize
1006KB
MD530b80ce7709ce2a6977218a8fab395de
SHA12f7543ece241170569f4de757b65838e200096fc
SHA256ce3db32f0a1270e7df858c983478198e330f199ea2b6b1fa5fe4dae8a5b12cc7
SHA5124afac006ccc833b86bffa255cd4d052a31c427982c9e91a89ae453db0eb04307d7344332fa573f1bb28f1849d84b5d0444648c45759113807612f15addabd685
-
Filesize
1006KB
MD530b80ce7709ce2a6977218a8fab395de
SHA12f7543ece241170569f4de757b65838e200096fc
SHA256ce3db32f0a1270e7df858c983478198e330f199ea2b6b1fa5fe4dae8a5b12cc7
SHA5124afac006ccc833b86bffa255cd4d052a31c427982c9e91a89ae453db0eb04307d7344332fa573f1bb28f1849d84b5d0444648c45759113807612f15addabd685
-
Filesize
1.5MB
MD51c51deb1bba6e464f0577bc37406b334
SHA1c19c0bb0df2c8b88bf054f0bddd470f61c1d74aa
SHA256d1c3b3b7642aec487f30237e2d31aeaa28bffcc4d839ea11a7a48d1e8e94153d
SHA512431c6fd57d7dd4c3593b496bc2ed3c1abd7aadedc1d9f85ff996cc17ee89dd3e90db34b431c47a7a729e86f7e8fef72a869dcc34b36761f012e8e3c7f5a01302
-
Filesize
1.5MB
MD51c51deb1bba6e464f0577bc37406b334
SHA1c19c0bb0df2c8b88bf054f0bddd470f61c1d74aa
SHA256d1c3b3b7642aec487f30237e2d31aeaa28bffcc4d839ea11a7a48d1e8e94153d
SHA512431c6fd57d7dd4c3593b496bc2ed3c1abd7aadedc1d9f85ff996cc17ee89dd3e90db34b431c47a7a729e86f7e8fef72a869dcc34b36761f012e8e3c7f5a01302