Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
27/11/2023, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe
Resource
win10-20231023-en
General
-
Target
21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe
-
Size
1.7MB
-
MD5
1a892ba96a906182bdea3b5bd458e3fe
-
SHA1
240981cfbaad71ac428d8b4d63316f919bb5f178
-
SHA256
21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f
-
SHA512
ad1953e4d64d69ffabce499e11b48e8bebf8dac34ff6862bd57f3847c302a147876884d8bdd2057f073cbd322a13c97d09f9f47a455fe72beb6883a599a8093c
-
SSDEEP
24576:ly6jqX3ywZY1MUKIDSc5xzOzqmkHqQxgNZHzRW0z+H04H6cDogLU8lAF29J+1Dhq:A8YS199x5FJKQWNZNW0q0UFH0MH+d
Malware Config
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1hP76Jy1.exe -
Executes dropped EXE 4 IoCs
pid Process 1756 eG5jn38.exe 4556 KO7hn89.exe 2488 Px0Fa32.exe 192 1hP76Jy1.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" eG5jn38.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" KO7hn89.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" Px0Fa32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1hP76Jy1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1412 schtasks.exe 5000 schtasks.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1756 1248 21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe 70 PID 1248 wrote to memory of 1756 1248 21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe 70 PID 1248 wrote to memory of 1756 1248 21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe 70 PID 1756 wrote to memory of 4556 1756 eG5jn38.exe 71 PID 1756 wrote to memory of 4556 1756 eG5jn38.exe 71 PID 1756 wrote to memory of 4556 1756 eG5jn38.exe 71 PID 4556 wrote to memory of 2488 4556 KO7hn89.exe 72 PID 4556 wrote to memory of 2488 4556 KO7hn89.exe 72 PID 4556 wrote to memory of 2488 4556 KO7hn89.exe 72 PID 2488 wrote to memory of 192 2488 Px0Fa32.exe 73 PID 2488 wrote to memory of 192 2488 Px0Fa32.exe 73 PID 2488 wrote to memory of 192 2488 Px0Fa32.exe 73 PID 192 wrote to memory of 1412 192 1hP76Jy1.exe 74 PID 192 wrote to memory of 1412 192 1hP76Jy1.exe 74 PID 192 wrote to memory of 1412 192 1hP76Jy1.exe 74 PID 192 wrote to memory of 5000 192 1hP76Jy1.exe 76 PID 192 wrote to memory of 5000 192 1hP76Jy1.exe 76 PID 192 wrote to memory of 5000 192 1hP76Jy1.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe"C:\Users\Admin\AppData\Local\Temp\21d13e8a77f57deedcd17b396f9f7f126cf5ea3b1b471ee7eaf967d88669073f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eG5jn38.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eG5jn38.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO7hn89.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO7hn89.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Px0Fa32.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Px0Fa32.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hP76Jy1.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hP76Jy1.exe5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:1412
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:5000
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD50f2eaa1790c228125d3f497446459d2a
SHA194feef00ec2df292db4f9a6022fc8e3cec9f0ffc
SHA256b93cdd504e8fb463279c11ccd423044e29867a47c51cb814860ac4e595f9b403
SHA51271f29a222a5f1121589d06173a9f29ba4c9faa3a55914e6c4cac896fedfdcb694e994d7405469f909f3442a134faefaa30e9b26815a9a40c67434b3983fb3ade
-
Filesize
1.5MB
MD5f0cf726155cb320911c52b4d610a7097
SHA1f9ad365bc3955d704a589ffd7ca5c6eaa2abe8fa
SHA256de2021537520312a49bd215f7e1fe9abac2f2a80e83b3711f5006b62535870cc
SHA512aada06b957c6c1894e1a89a073626471997164ea1480951935598c50f53bbeab2f6685a18ca3d32c6a06a6aa38ede69e5673c4a78bd2bec2f8c838ed9015dcbe
-
Filesize
1.5MB
MD5f0cf726155cb320911c52b4d610a7097
SHA1f9ad365bc3955d704a589ffd7ca5c6eaa2abe8fa
SHA256de2021537520312a49bd215f7e1fe9abac2f2a80e83b3711f5006b62535870cc
SHA512aada06b957c6c1894e1a89a073626471997164ea1480951935598c50f53bbeab2f6685a18ca3d32c6a06a6aa38ede69e5673c4a78bd2bec2f8c838ed9015dcbe
-
Filesize
1011KB
MD5518654f534e667a7a0e3983bc990a8ef
SHA1a897748fc0835b5be49608bae49dc8066bcfd479
SHA256efa7e0499d7174b8c846c36c85c3e7a35c62ab8325ef0fa000012530cf0caa98
SHA512b43b3cd3294fff4e47086e196873edd8b9c1a8beb28cc01ac5c578edc5c7182d8370d6bed9e9c03e82e444c32f1075d06fddbaeef6fa3da48f890d20d07c69dc
-
Filesize
1011KB
MD5518654f534e667a7a0e3983bc990a8ef
SHA1a897748fc0835b5be49608bae49dc8066bcfd479
SHA256efa7e0499d7174b8c846c36c85c3e7a35c62ab8325ef0fa000012530cf0caa98
SHA512b43b3cd3294fff4e47086e196873edd8b9c1a8beb28cc01ac5c578edc5c7182d8370d6bed9e9c03e82e444c32f1075d06fddbaeef6fa3da48f890d20d07c69dc
-
Filesize
888KB
MD53e602b5c6aaf2430520ea460c2042491
SHA1ce8955dcbc8aecb71d9b5ce49adcda29157a3b65
SHA256b2ea25878f08652bbac82ae248902c2084c3c677d6ea45e2d36be1f72243d365
SHA512a8525e0861a84a1832daf14ec3c8cae83706938bc19ce2494283df5cd72a640c14194dfa507d9bde77bde2819571a03116aa746cd8fa232afa5f170570508e38
-
Filesize
888KB
MD53e602b5c6aaf2430520ea460c2042491
SHA1ce8955dcbc8aecb71d9b5ce49adcda29157a3b65
SHA256b2ea25878f08652bbac82ae248902c2084c3c677d6ea45e2d36be1f72243d365
SHA512a8525e0861a84a1832daf14ec3c8cae83706938bc19ce2494283df5cd72a640c14194dfa507d9bde77bde2819571a03116aa746cd8fa232afa5f170570508e38
-
Filesize
1.5MB
MD50f2eaa1790c228125d3f497446459d2a
SHA194feef00ec2df292db4f9a6022fc8e3cec9f0ffc
SHA256b93cdd504e8fb463279c11ccd423044e29867a47c51cb814860ac4e595f9b403
SHA51271f29a222a5f1121589d06173a9f29ba4c9faa3a55914e6c4cac896fedfdcb694e994d7405469f909f3442a134faefaa30e9b26815a9a40c67434b3983fb3ade
-
Filesize
1.5MB
MD50f2eaa1790c228125d3f497446459d2a
SHA194feef00ec2df292db4f9a6022fc8e3cec9f0ffc
SHA256b93cdd504e8fb463279c11ccd423044e29867a47c51cb814860ac4e595f9b403
SHA51271f29a222a5f1121589d06173a9f29ba4c9faa3a55914e6c4cac896fedfdcb694e994d7405469f909f3442a134faefaa30e9b26815a9a40c67434b3983fb3ade