Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/11/2023, 15:23

General

  • Target

    68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe

  • Size

    1.9MB

  • MD5

    39e20b6c192664e74aa283bad52cb1e8

  • SHA1

    a894d560dee4033ce6fb4f829374163c605fd588

  • SHA256

    68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1

  • SHA512

    80d08668fbd8678e01bc5a95f237563e3658ccffc764f72217127651c9eea4a49084b0b10f5a99fd49e2f62a6f85671b6f092f77d6d5674b4c52f3cccaa48a4e

  • SSDEEP

    24576:syPyYoH+Bd5tKoWQiUZeMGU/6oOCcjMirjkcCUKK7AiRY/jJx5b6lyAmY:ba/eBd5tZiUGO6nCcj3QcTpKrJr6S

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe
    "C:\Users\Admin\AppData\Local\Temp\68885b0b4b41c0bfb876cb6efb174ac0c98b48b215501840bfea579f35314ae1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ym8Ev33.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ym8Ev33.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8Vm52.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8Vm52.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4560
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tf7UR54.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tf7UR54.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dV92Na5.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dV92Na5.exe
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:4508
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
              6⤵
              • Creates scheduled task(s)
              PID:3244
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
              6⤵
              • Creates scheduled task(s)
              PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

    Filesize

    1.5MB

    MD5

    1c51deb1bba6e464f0577bc37406b334

    SHA1

    c19c0bb0df2c8b88bf054f0bddd470f61c1d74aa

    SHA256

    d1c3b3b7642aec487f30237e2d31aeaa28bffcc4d839ea11a7a48d1e8e94153d

    SHA512

    431c6fd57d7dd4c3593b496bc2ed3c1abd7aadedc1d9f85ff996cc17ee89dd3e90db34b431c47a7a729e86f7e8fef72a869dcc34b36761f012e8e3c7f5a01302

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ym8Ev33.exe

    Filesize

    1.6MB

    MD5

    89fdd7d307b84e4438f122f82d12cdcb

    SHA1

    9125437f6b7b1095effbfe9a9169eb7f43b44a33

    SHA256

    ae5fef89e4ac27b9eeacfb2bb259de20d6e2aa7dad494d5237322377b943be79

    SHA512

    0633fc267d092c6e0595577c370756df90f424dbce6e7b9cb82a6d31d05661a5c1693de77bf05a877af6a8bc4ef26e6a7859a3953986a45d0030c9adf382456f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ym8Ev33.exe

    Filesize

    1.6MB

    MD5

    89fdd7d307b84e4438f122f82d12cdcb

    SHA1

    9125437f6b7b1095effbfe9a9169eb7f43b44a33

    SHA256

    ae5fef89e4ac27b9eeacfb2bb259de20d6e2aa7dad494d5237322377b943be79

    SHA512

    0633fc267d092c6e0595577c370756df90f424dbce6e7b9cb82a6d31d05661a5c1693de77bf05a877af6a8bc4ef26e6a7859a3953986a45d0030c9adf382456f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8Vm52.exe

    Filesize

    1.1MB

    MD5

    f4959dc5fdf2db19ec08a33c72da77fd

    SHA1

    b3b24927546b51db20c3ce6106dd0b591e105c4f

    SHA256

    2024a04c8039caaf332c25f731a4d8808878974a2b213d2ddcc19559af9cd714

    SHA512

    38d4f618078584ef203da1098957d103120f1b9e781a8f9c1141d160bf2fc219c11c8d0453789c6ad39384c617005263cbb10bd636eeee065d5d22b93081535a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NF8Vm52.exe

    Filesize

    1.1MB

    MD5

    f4959dc5fdf2db19ec08a33c72da77fd

    SHA1

    b3b24927546b51db20c3ce6106dd0b591e105c4f

    SHA256

    2024a04c8039caaf332c25f731a4d8808878974a2b213d2ddcc19559af9cd714

    SHA512

    38d4f618078584ef203da1098957d103120f1b9e781a8f9c1141d160bf2fc219c11c8d0453789c6ad39384c617005263cbb10bd636eeee065d5d22b93081535a

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tf7UR54.exe

    Filesize

    1006KB

    MD5

    30b80ce7709ce2a6977218a8fab395de

    SHA1

    2f7543ece241170569f4de757b65838e200096fc

    SHA256

    ce3db32f0a1270e7df858c983478198e330f199ea2b6b1fa5fe4dae8a5b12cc7

    SHA512

    4afac006ccc833b86bffa255cd4d052a31c427982c9e91a89ae453db0eb04307d7344332fa573f1bb28f1849d84b5d0444648c45759113807612f15addabd685

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tf7UR54.exe

    Filesize

    1006KB

    MD5

    30b80ce7709ce2a6977218a8fab395de

    SHA1

    2f7543ece241170569f4de757b65838e200096fc

    SHA256

    ce3db32f0a1270e7df858c983478198e330f199ea2b6b1fa5fe4dae8a5b12cc7

    SHA512

    4afac006ccc833b86bffa255cd4d052a31c427982c9e91a89ae453db0eb04307d7344332fa573f1bb28f1849d84b5d0444648c45759113807612f15addabd685

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dV92Na5.exe

    Filesize

    1.5MB

    MD5

    1c51deb1bba6e464f0577bc37406b334

    SHA1

    c19c0bb0df2c8b88bf054f0bddd470f61c1d74aa

    SHA256

    d1c3b3b7642aec487f30237e2d31aeaa28bffcc4d839ea11a7a48d1e8e94153d

    SHA512

    431c6fd57d7dd4c3593b496bc2ed3c1abd7aadedc1d9f85ff996cc17ee89dd3e90db34b431c47a7a729e86f7e8fef72a869dcc34b36761f012e8e3c7f5a01302

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dV92Na5.exe

    Filesize

    1.5MB

    MD5

    1c51deb1bba6e464f0577bc37406b334

    SHA1

    c19c0bb0df2c8b88bf054f0bddd470f61c1d74aa

    SHA256

    d1c3b3b7642aec487f30237e2d31aeaa28bffcc4d839ea11a7a48d1e8e94153d

    SHA512

    431c6fd57d7dd4c3593b496bc2ed3c1abd7aadedc1d9f85ff996cc17ee89dd3e90db34b431c47a7a729e86f7e8fef72a869dcc34b36761f012e8e3c7f5a01302